CVE-2025-49146: falha de alta gravidade em pgjdbc
pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
pgjdbc · pgjdbcCVEs relacionadas — pgjdbc
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1597CRITICALpgjdbc SQL Injection via line comment generationEPSS 4.8%CVE-2026-42198HIGHpgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSEPSS 3.3%CVE-2022-31197HIGHSQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbcEPSS 2.4%CVE-2022-41946MEDIUMTemporaryFolder on unix-like systems does not limit access to created files in pgjdbcEPSS 0.6%CVE-2026-107314MEDIUMpgjdbc does not enforce requireAuth when the value excludes every authentication methodEPSS 0.3%CVE-2026-54291HIGHSilent channel-binding authentication downgrade via unsupported certificate algorithmsEPSS 0.2%