Threats tagged 'ghsa-gfpv-wrhp-wwh6'

A vulnerability in PostgreSQL's GSSAPI support allows users to bypass pg_hba.conf rules by negotiating GSSAPI improperly via an initial direct TLS connection. This can result in connections using TLS encryption alone, potentially with weaker protection than intended. The issue affects PostgreSQL major versions 17 and 18, specifically versions before 18.5 and 17.11. Versions prior to 17 are not affected.