This vulnerability in PostgreSQL arises from a covert timing channel in the MD5 password comparison mechanism used during authentication. An attacker can exploit this timing discrepancy to recover user credentials, enabling authentication as that user. The issue specifically affects MD5-hashed passwords, which may persist in databases upgraded from PostgreSQL 13 or earlier. The vulnerability does not impact scram-sha-256 password authentication, which is the default in all supported PostgreSQL versions. Affected versions include those prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23. Red Hat has issued security advisories and updates addressing this vulnerability, with patched versions available.

The vulnerability allows an attacker to recover user credentials through a covert timing channel in the MD5 password comparison process. This can lead to unauthorized authentication as the targeted user. The impact is limited to systems using MD5-hashed passwords, which are legacy from upgrades prior to PostgreSQL 14. Systems using the default scram-sha-256 password method are not affected. The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Red Hat has released security updates that fix this vulnerability in PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23. Users should apply these official patches to remediate the issue. Since this vulnerability only affects MD5-hashed passwords, migrating to scram-sha-256 password authentication, which is the default in supported releases, also mitigates the risk. Patch status is confirmed by Red Hat advisories. No additional action is required beyond applying the updates and migrating password hashes where applicable.