| Name | CVE-2026-107314 |
| Description | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1150330 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libpgjava (PTS) | bookworm | 42.5.5-0+deb12u1 | fixed |
| trixie | 42.7.7-1 | fixed | |
| forky, sid | 42.7.13-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libpgjava | source | bookworm | (not affected) | |||
| libpgjava | source | trixie | (not affected) | |||
| libpgjava | source | (unstable) | (unfixed) | 1150330 |
[trixie] - libpgjava <not-affected> (Vulnerable code not present, introduced in 42.7.11)
[bookworm] - libpgjava <not-affected> (Vulnerable code not present, introduced in 42.7.11)
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h
https://github.com/pgjdbc/pgjdbc/commit/a65ef98fe37bf0ecbd1a6331205cdb924985ed75 (REL42.7.14)