High · 7.5 CVE-2002-1657 EUVD-2002-1638GHSA-vjwv-wcj8-hxqj

PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brut…

Published Apr 22, 2005 · Updated Jan 16, 2025 · Assigned by mitre

Description

PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.

References

postgresql-md5-salt-weak-security(20215) vdb-entry
20050420 Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords mailing-list
20050420 Re: Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords mailing-list
[pgsql-admin] 20020821 Re: OT: password encryption (salt theory) mailing-list