agora inbox for pgsql-committers@postgresql.org  
help / color / mirror / Atom feed
pgsql: Use value of scram_iterations in mock_scram_secret().
5+ messages / 1 participants
[nested] [flat]

* pgsql: Use value of scram_iterations in mock_scram_secret().
@ 2026-08-10 13:41  Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 5+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Use value of scram_iterations in mock_scram_secret().

Presently, mock_scram_secret() always uses
SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable
response discrepancy hazard when scram_iterations is set to
something else.  To fix, use the value of the configuration
parameter instead, and document that unauthenticated users can
discover the existence of roles with passwords created with
different iteration counts.

Reported-by: Radim Marek <radim@boringsql.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi>
Reviewed-by: Jacob Champion <champion.p@gmail.com>
Security: CVE-2026-14672
Backpatch-through: 16

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/feb8b0182ffa38a51fb6b964bd5b97dd666d4da0
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
doc/src/sgml/config.sgml       | 13 +++++++++++++
src/backend/libpq/auth-scram.c |  2 +-
2 files changed, 14 insertions(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 5+ messages in thread

* pgsql: Use value of scram_iterations in mock_scram_secret().
@ 2026-08-10 13:41  Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 5+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Use value of scram_iterations in mock_scram_secret().

Presently, mock_scram_secret() always uses
SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable
response discrepancy hazard when scram_iterations is set to
something else.  To fix, use the value of the configuration
parameter instead, and document that unauthenticated users can
discover the existence of roles with passwords created with
different iteration counts.

Reported-by: Radim Marek <radim@boringsql.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi>
Reviewed-by: Jacob Champion <champion.p@gmail.com>
Security: CVE-2026-14672
Backpatch-through: 16

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/4d192fa168cf43c6431bf96941d8c709bb92bf5d
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
doc/src/sgml/config.sgml       | 13 +++++++++++++
src/backend/libpq/auth-scram.c |  2 +-
2 files changed, 14 insertions(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 5+ messages in thread

* pgsql: Use value of scram_iterations in mock_scram_secret().
@ 2026-08-10 13:41  Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 5+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Use value of scram_iterations in mock_scram_secret().

Presently, mock_scram_secret() always uses
SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable
response discrepancy hazard when scram_iterations is set to
something else.  To fix, use the value of the configuration
parameter instead, and document that unauthenticated users can
discover the existence of roles with passwords created with
different iteration counts.

Reported-by: Radim Marek <radim@boringsql.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi>
Reviewed-by: Jacob Champion <champion.p@gmail.com>
Security: CVE-2026-14672
Backpatch-through: 16

Branch
------
REL_18_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/822143c4d1dce62a43b98341eacbd4429eca7e59
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
doc/src/sgml/config.sgml       | 13 +++++++++++++
src/backend/libpq/auth-scram.c |  2 +-
2 files changed, 14 insertions(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 5+ messages in thread

* pgsql: Use value of scram_iterations in mock_scram_secret().
@ 2026-08-10 13:41  Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 5+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Use value of scram_iterations in mock_scram_secret().

Presently, mock_scram_secret() always uses
SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable
response discrepancy hazard when scram_iterations is set to
something else.  To fix, use the value of the configuration
parameter instead, and document that unauthenticated users can
discover the existence of roles with passwords created with
different iteration counts.

Reported-by: Radim Marek <radim@boringsql.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi>
Reviewed-by: Jacob Champion <champion.p@gmail.com>
Security: CVE-2026-14672
Backpatch-through: 16

Branch
------
REL_17_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/dec60e8ada4cd46d0201efea844a4b22cb06444e
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
doc/src/sgml/config.sgml       | 13 +++++++++++++
src/backend/libpq/auth-scram.c |  2 +-
2 files changed, 14 insertions(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 5+ messages in thread

* pgsql: Use value of scram_iterations in mock_scram_secret().
@ 2026-08-10 13:41  Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 5+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Use value of scram_iterations in mock_scram_secret().

Presently, mock_scram_secret() always uses
SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable
response discrepancy hazard when scram_iterations is set to
something else.  To fix, use the value of the configuration
parameter instead, and document that unauthenticated users can
discover the existence of roles with passwords created with
different iteration counts.

Reported-by: Radim Marek <radim@boringsql.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi>
Reviewed-by: Jacob Champion <champion.p@gmail.com>
Security: CVE-2026-14672
Backpatch-through: 16

Branch
------
REL_16_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/fadbe882d16112fd8c5ccf2b73eb9621dbfe130a
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
doc/src/sgml/config.sgml       | 13 +++++++++++++
src/backend/libpq/auth-scram.c |  2 +-
2 files changed, 14 insertions(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 5+ messages in thread


end of thread, other threads:[~2026-08-10 13:41 UTC | newest]

Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Use value of scram_iterations in mock_scram_secret(). Noah Misch <noah@leadboat.com>

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox