MEDIUM🇵🇱 Wersja polska

CVE-2026-6478

CVSS 6.5v3.1pub. 2026-05-14upd. 2026-08-25

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

  • PostgreSQL

    APP
    Postgresql
    < 14.2315.0 – 15.18 (excl.)16.0 – 16.14 (excl.)17.0 – 17.10 (excl.)18.0 – 18.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2015-0244CRITICAL9.8PL ✓same product

SQL injection w PostgreSQL przez błąd synchronizacji protokołu

CVE-2015-3166CRITICAL9.8PL ✓same product

PostgreSQL: błąd obsługi błędów systemowych w implementacji snprintf

CVE-2019-10211CRITICAL9.8PL ✓same product

PostgreSQL Windows Installer — wykonanie kodu z niezabezpieczonego katalogu (OpenSSL)

CVE-2018-16850CRITICAL9.8PL ✓same product

SQL injection w PostgreSQL via CREATE TRIGGER — wykonanie kodu z uprawnieniami superusera

CVE-2018-1115CRITICAL9.1PL ✓same product

PostgreSQL adminpack: brak kontroli ACL w funkcji pg_logfile_rotate()