Threats tagged 'ghsa-98qh-xjc8-98pq'

The pgjdbc PostgreSQL JDBC driver is vulnerable to a client-side denial of service (DoS) during SCRAM-SHA-256 authentication. A malicious or compromised PostgreSQL server can specify an excessively large PBKDF2 iteration count, causing the client to spend an unbounded amount of CPU time computing the key derivation function. This can exhaust CPU resources on the client, especially with repeated or concurrent connection attempts. The vulnerability affects versions from 42.2.0 up to but not including 42.7.11. A patch is available in version 42.7.11 that caps the maximum allowed PBKDF2 iterations. The issue impacts availability but does not allow authentication bypass or data disclosure.