CyberRota Analysis
AI-GeneratedThe pgjdbc PostgreSQL JDBC Driver versions 42.7.4 to 42.7.11 are vulnerable due to a flaw that allows channelBinding=require connections to be downgraded from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256, compromising man-in-the-middle protection. This vulnerability can be exploited by an attacker intercepting the TLS connection, potentially leading to unauthorized access or data exposure. Organizations using affected versions of pgjdbc should prioritize upgrading to version 42.7.12 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)