Bug#1150330: libpgjava: CVE-2026-107315 CVE-2026-107314

[Moritz Mühlenhoff]

Source: libpgjava
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerabilities were published for libpgjava.

CVE-2026-107315[0]:
| pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13
| pads a value that is shorter than its declared length with bytes
| left in its send buffer instead of zeros, and the server stores
| those bytes as part of the value. The bytes are messages the driver
| sent earlier on the same connection: SQL text and parameter values
| of recent statements, which on a pooled connection can come from
| other requests. Each padded value can carry up to 8192 bytes of this
| traffic, or 16320 bytes on a connection with GSS encryption. The
| padding happens when an application declares a length larger than
| the data it supplies, through PreparedStatement.setObject with a
| ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write,
| LargeObject.write, or Blob.setBytes. The driver accepts these calls
| without an error. An attacker who can make the application store
| such a value and read it back can collect earlier traffic.
| Applications whose declared lengths always match their data are not
| affected. Versions 42.7.3 and earlier pad with zeros.

https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3
https://github.com/pgjdbc/pgjdbc/commit/c8998c8e9632a7cdecb128dd7cd122d330b3598a (REL42.7.14)

CVE-2026-107314[1]:
| pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13
| enforce no restriction when the requireAuth connection property
| excludes all six authentication methods the driver knows, for
| example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none.
| The driver then accepts any method the server asks for, including
| cleartext password authentication. A value without a method in it,
| such as requireAuth=, (a single comma), is affected the same way. An
| attacker positioned between the application and its server can ask
| for cleartext password authentication and receive the database
| password. A positive list such as requireAuth=scram-sha-256, and a
| partial exclusion such as requireAuth=!password,!md5, are enforced
| correctly. The property has no default value, so a deployment that
| does not set it is not affected. 42.7.14 fixes the problem: such a
| connection is refused with SQLState 08004, and a value without a
| method in it is rejected as invalid.

https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h
https://github.com/pgjdbc/pgjdbc/commit/a65ef98fe37bf0ecbd1a6331205cdb924985ed75 (REL42.7.14)
 

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107315
    https://www.cve.org/CVERecord?id=CVE-2026-107315
[1] https://security-tracker.debian.org/tracker/CVE-2026-107314
    https://www.cve.org/CVERecord?id=CVE-2026-107314

Please adjust the affected versions in the BTS as needed.