[From nobody Fri Oct 9 10:53:05 2026 Received: (at 1150330-close) by bugs.debian.org; 9 Oct 2026 09:51:30 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 87; hammy, 150; neutral, 249; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:46566) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xF7GE-001xcS-2B for 1150330-close@bugs.debian.org; Fri, 09 Oct 2026 09:51:30 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xF7GD-000Wtk-2j for 1150330-close@bugs.debian.org; Fri, 09 Oct 2026 09:51:29 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=Upgq5MyRC3G4ufnoGNd1wnx+8XhOIjiqv/gkB+Ch0wY=; b=b4qRpdeT8gjnMiGTDy2rLSZwwd gMyrN/KK3fKMZimL9dg5ZkUfyGYo05QfYLxGTY87zukhCRqVoRyOsweQsuj8gOZ4f7U+ReNKxwecB kcllQGgkWTp7mqhsGtPiA6nNjqMeRy/ZWGctnU7IIOUZsWAIaGt554MTT3Qk20cSrjYQiNfW0svhE D0JGtEcjBb40VWdXDlPqWipwBBPUODCrxOrus4xT0VN0848EFEQupc4ThX9wTTL22I3s5+hDULqTs 64b9jP2pqorxMWaMr6laE633+1UFoJvQhLd0y4x4ucYU8b5/W1BkQRy/Z8ZcBjSId2BAEb/XYbxpW G5vzpInA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xF7GD-0000000FyGY-0DB3; Fri, 09 Oct 2026 09:51:29 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Christoph Berg <myon@debian.org> To: 1150330-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: libpgjava Debian: DAK Debian-Changes: libpgjava_42.7.14-1_source.changes Debian-Source: libpgjava Debian-Version: 42.7.14-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1150330: fixed in libpgjava 42.7.14-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8338225411295516693==" Message-Id: <E1xF7GD-0000000FyGY-0DB3@fasolo.debian.org> Date: Fri, 09 Oct 2026 09:51:29 +0000 --===============8338225411295516693== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libpgjava Source-Version: 42.7.14-1 Done: Christoph Berg <myon@debian.org> We believe that the bug you reported is fixed in the latest version of libpgjava, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1150330@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Christoph Berg <myon@debian.org> (supplier of updated libpgjava package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 09 Oct 2026 11:14:28 +0200 Source: libpgjava Architecture: source Version: 42.7.14-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Christoph Berg <myon@debian.org> Closes: 1150330 Changes: libpgjava (42.7.14-1) unstable; urgency=3Dmedium . * New upstream version 42.7.14. (Closes: #1150330) + CVE-2026-107315: versions 42.7.4 through 42.7.13 pad a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which = on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes on a connection with GSS encryption. The padding happens when an application declares a length larger than the data it supplies, through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCop= y, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The driver accepts these calls without an error. An attacker who can make the application store such a value and read it back can collect earlier traffic. Applications whose declared lengths always match their data a= re not affected. Versions 42.7.3 and earlier pad with zeros. + CVE-2026-107314: versions 42.7.11 through 42.7.13 enforce no restricti= on when the requireAuth connection property excludes all six authenticati= on methods the driver knows, for example requireAuth=3D!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driv= er then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=3D, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=3Dscram-sha-256, and a partial exclusion such= as requireAuth=3D!password,!md5, are enforced correctly. The property has= no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid. Checksums-Sha1: 944da05a66bf5092fbe5345307a1aef2801681e9 2426 libpgjava_42.7.14-1.dsc 522aed9be110272187ff0b7b7e5d771acbf6e3a0 1224149 libpgjava_42.7.14.orig.tar.= gz 98c9dda4625a12fac5174dce8a8a51037226d9ec 11764 libpgjava_42.7.14-1.debian.ta= r.xz Checksums-Sha256: c14c83a5486cf4da479ddab38f3e3b21ac9cdea8f4d97175e5e8a7cef5b566e8 2426 libpgj= ava_42.7.14-1.dsc 1f38e5e32f1e9b2200f6c0e7cce02d635d7bc14b35dff803a52e09cd666a16b9 1224149 lib= pgjava_42.7.14.orig.tar.gz 5a614a21193cf7ffdfdaf334433307d3628cb10beddc02bd292fc3eb76da26ed 11764 libpg= java_42.7.14-1.debian.tar.xz Files: 086da6a46f697a8f81d33dc933aad648 2426 java optional libpgjava_42.7.14-1.dsc abe9eb01a66a7a2371e5eb154fd5fc93 1224149 java optional libpgjava_42.7.14.ori= g.tar.gz 86e1b2fac82844b291ec4f280671fe72 11764 java optional libpgjava_42.7.14-1.deb= ian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmrItU4ACgkQTFprqxLS p663kQ//QCwMgWr+nYJT1ZbWlwjtGJKzcj8J0tYimgp2gxKZnpk4eIHP+6RLIqcq 293419kM3DUf1gq1pzhxHgwhO+NZQocYiDlUAojaa/4iJDGWKHKxGgMqCyD/DK57 UXKqx6jkYHC6Go6hzeLe6HEU8DgGHkOXUqyoNTZVxh6uJVlT9zTDHr9M0cPc70bP 76kNw9zhDizk9C8Eo7VAloK3E2vcag/mjE0Ceo7c5IU1YWHTB7PZk5uSyqNtb+B9 /A4E1s8aFO4+p9LrrPYKRE1wa4NPSKMuufHvpXCfnpCoFPVCxwiQLtl6GE9wrsvg TU9YS+L+AuXdgTLyCyGebJLq5QOk8jyDHgCjqIwmFZrxqcEAFdljWbPMUkfXQ5Fq KkJPjE9fJtg1MMIrU83jPK9KwRGjN06Xzcqcs8gW+bc2UZop8geuj19cHeZWQUaa 39IoXKo3N/1xE0xQz6I3OerV5ByXTS0VIg+z78LUgdD5YazQCtdU2RcKlxNAT5qD l9UpphixHyKnZ2LBv6j0lnR8fvu4g7ZIUPR8KgGn88rDe1bCHHokAJaMgENg9eNM tmcwUVb0rNFOYQRagJbO8WffINCRYv4Ms4LScGZox/CqmsNjd7zveZIiW8RM4hlk HitTys285CMBtQ8PWHEFX5j3yym85p5Cva1SSIeKnX+guJTaZdo=3D =3Dbd+B -----END PGP SIGNATURE----- --===============8338225411295516693== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCasi5IQAKCRCb9qggYcy5 ISn9AP4uYxZAKLg+IPUtL0l3dYsKqAi/RD5LX45qYa4GRFwOFQEA/0nd9ksbrQRT nNw1yg/WSoPXH4PRV+OJnS/aiS9M3g0= =3OX3 -----END PGP SIGNATURE----- --===============8338225411295516693==-- ]