Most recent entries from all

bdu:2026-11965

BIT-postgresql-2026-14681 — PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL

Affected: Bitnami: postgresql

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

certfr-2026-avi-1024 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de p…

certfr-2026-avi-1024

EUVD-2026-361656

fkie_cve-2026-14681

GHSA-gfpv-wrhp-wwh6

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

OESA-2026-3423 — postgresql-17 security update

Affected: openEuler:24.03-LTS-SP4: postgresql-17

PostgreSQL client programs Security Fix(es):

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14663)

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system use…

openSUSE-SU-2026:11555-1 — postgresql17-17.11-1.1 on GA media

postgresql17-17.11-1.1 on GA media

SUSE-SU-2026:23577-1 — Security update for postgresql18

Security update for postgresql18

UBUNTU-CVE-2026-14681

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:26.04:LTS: postgresql-18

WID-SEC-W-2026-2844 — PostgreSQL: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.