RHLW-2026-5d9055c93ed2ae4d: Lightwell Security Advisory: postgresql 42.7.12.rhlw-00003
Red Hat Lightwell has released org.postgresql:postgresql 42.7.12.rhlw-00003 with backported fixes for CVE-2026-107314 and CVE-2026-107315.
CVE-2026-107314: pgjdbc does not enforce requireAuth when the value excludes every authentication method
CVE-2026-107315: pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)
This patched artifact is a drop-in replacement for org.postgresql:postgresql 42.7.12 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.postgresql:postgresqlto a version that resolves this vulnerability.Fixed in 42.7.12.rhlw-00003 - Upgrade
Upgrade
org.postgresql:postgresqlto a version that resolves this vulnerability.Fixed in 42.7.12.rhlw-00003
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What deployment change addresses these issues?
Use Red Hat Lightwell's org.postgresql:postgresql 42.7.12.rhlw-00003 artifact. It is described as a drop-in replacement for org.postgresql:postgresql 42.7.12 from Maven Central.
What conditions are indicated by the severity vector?
The vector indicates network reachability, no required privileges, and no user interaction, but high attack complexity. The stated impacts are high confidentiality impact with no integrity or availability impact.