CVE-2025-49146: pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
Impact When the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.
Patches TBD
Workarounds
Configure sslMode=verify-full to prevent MITM attacks.
References
https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256 https://datatracker.ietf.org/doc/html/rfc7677 https://datatracker.ietf.org/doc/html/rfc5802
Other sources
pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49146?
CVE-2025-49146 is considered a medium severity vulnerability due to its potential impact on secure connections in PostgreSQL JDBC driver configurations.
How do I fix CVE-2025-49146?
To fix CVE-2025-49146, update the PostgreSQL JDBC driver to version 42.7.8 or higher, which addresses the channel binding misconfiguration.
What configurations are affected by CVE-2025-49146?
CVE-2025-49146 affects PostgreSQL JDBC driver configurations specifically when channel binding is set to 'required'.
What authentication methods are incompatible with channel binding in CVE-2025-49146?
CVE-2025-49146 outlines that authentication methods like password, MD5, GSS, and SSPI do not support channel binding when required.
Is CVE-2025-49146 a common vulnerability in PostgreSQL setups?
CVE-2025-49146 may occur in PostgreSQL setups that have the JDBC driver incorrectly configured for channel binding, making it important for users to verify their configurations.