REDHAT-BUG-2372307: High severity PostgreSQL JDBC Driver vulnerability
pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2372307?
The severity of REDHAT-BUG-2372307 is considered high due to the potential for unauthorized access through misconfigured authentication.
How do I fix REDHAT-BUG-2372307?
To fix REDHAT-BUG-2372307, update the PostgreSQL JDBC Driver to a version higher than 42.7.7.
Which versions of PostgreSQL JDBC Driver are affected by REDHAT-BUG-2372307?
Versions 42.7.4 through 42.7.7 of the PostgreSQL JDBC Driver are affected by REDHAT-BUG-2372307.
What issue does REDHAT-BUG-2372307 describe regarding channel binding?
REDHAT-BUG-2372307 describes an issue where the PostgreSQL JDBC Driver incorrectly allows connections with authentication methods that do not support channel binding when configured to require it.
What configuration is relevant to REDHAT-BUG-2372307?
The relevant configuration for REDHAT-BUG-2372307 is the channel binding setting in the PostgreSQL JDBC Driver, which defaults to 'prefer' but can be set to 'required'.