REDHAT-BUG-2477447: High severity PostgreSQL postgresql vulnerability
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.4 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.10 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.14 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.18 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.23
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477447?
The severity of REDHAT-BUG-2477447 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2477447?
To mitigate REDHAT-BUG-2477447, it is recommended to switch from MD5-hashed passwords to scram-sha-256 for PostgreSQL authentication.
What systems are affected by REDHAT-BUG-2477447?
REDHAT-BUG-2477447 affects PostgreSQL systems that use MD5-hashed passwords for authentication.
How does REDHAT-BUG-2477447 impact user security?
REDHAT-BUG-2477447 allows attackers to exploit a covert timing channel to recover user credentials, posing a significant security risk.
Is my data safe if I use scram-sha-256 instead of MD5 with PostgreSQL?
Yes, using scram-sha-256 passwords in PostgreSQL is safe and is not affected by REDHAT-BUG-2477447.