Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN724
_____________________________________________________________________


DATE                : 07/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running PostgreSQL JDBC versions prior
                                    to 42.7.12.
 
=====================================================================

https://www.postgresql.org/about/news/postgresql-jdbc-42712-security-release-3340/
_____________________________________________________________________


PostgreSQL JDBC 42.7.12 Security Release

Related Proprietary Security

Silent channel-binding authentication downgrade (CVE-2026-54291)
channelBinding=require connections can be silently downgraded from
SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256
(without it), losing the man-in-the-middle protection the setting is
meant to guarantee. An attacker who can intercept the TLS connection
triggers the downgrade with a certificate whose signature algorithm
has no tls-server-end-point channel-binding hash. Examples are
Ed25519, Ed448, and post-quantum algorithms.

Two issues combine in releases 42.7.4 through 42.7.11:

The bundled com.ongres.scram:scram-client (3.1 or 3.2) returns an
empty byte array instead of failing when it cannot derive the binding
hash for such a certificate. This is the library issue tracked as
GHSA-p9jg-fcr6-3mhf.

pgJDBC does not enforce channelBinding=require where it matters.
ScramAuthenticator checks only that the server advertised a -PLUS
mechanism; it neither rejects the empty binding nor checks that
the negotiated mechanism uses channel binding. The connection
therefore downgrades silently.

Only connections that set channelBinding=require are affected.
Under the default prefer policy, and under allow or disable,
falling back to plain SCRAM is the documented behaviour.

Releases before 42.7.4 are unaffected, because they do not support
channel binding.


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================