Description
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pgpool Global Development Group | Pgpool-II | 4.7.0 – ≤ 4.7.2, 4.6.0 – ≤ 4.6.7, 4.5.0 – ≤ 4.5.12, 4.4.0 – ≤ 4.4.17, 4.3.0 – ≤ 4.3.20, 3.5.x – ≤ 4.2.x | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pgpool2 | 4.7.3-1 | — |
| Debian 13 | pgpool2 | No fix yet | — |
| Debian 12 | pgpool2 | No fix yet | — |