agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Use value of scram_iterations in mock_scram_secret(). 5+ messages / 1 participants [nested] [flat]
* pgsql: Use value of scram_iterations in mock_scram_secret(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek <radim@boringsql.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi> Reviewed-by: Jacob Champion <champion.p@gmail.com> Security: CVE-2026-14672 Backpatch-through: 16 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/feb8b0182ffa38a51fb6b964bd5b97dd666d4da0 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Use value of scram_iterations in mock_scram_secret(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek <radim@boringsql.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi> Reviewed-by: Jacob Champion <champion.p@gmail.com> Security: CVE-2026-14672 Backpatch-through: 16 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4d192fa168cf43c6431bf96941d8c709bb92bf5d Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Use value of scram_iterations in mock_scram_secret(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek <radim@boringsql.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi> Reviewed-by: Jacob Champion <champion.p@gmail.com> Security: CVE-2026-14672 Backpatch-through: 16 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/822143c4d1dce62a43b98341eacbd4429eca7e59 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Use value of scram_iterations in mock_scram_secret(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek <radim@boringsql.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi> Reviewed-by: Jacob Champion <champion.p@gmail.com> Security: CVE-2026-14672 Backpatch-through: 16 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/dec60e8ada4cd46d0201efea844a4b22cb06444e Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Use value of scram_iterations in mock_scram_secret(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek <radim@boringsql.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi> Reviewed-by: Jacob Champion <champion.p@gmail.com> Security: CVE-2026-14672 Backpatch-through: 16 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/fadbe882d16112fd8c5ccf2b73eb9621dbfe130a Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox