libpgjava_42.7.14-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 09 Oct 2026 11:14:28 +0200
Source: libpgjava
Architecture: source
Version: 42.7.14-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
Changed-By: Christoph Berg <myon at debian.org>
Closes: 1150330
Changes:
 libpgjava (42.7.14-1) unstable; urgency=medium
 .
   * New upstream version 42.7.14. (Closes: #1150330)
     + CVE-2026-107315: versions 42.7.4 through 42.7.13 pad a value that is
       shorter than its declared length with bytes left in its send buffer
       instead of zeros, and the server stores those bytes as part of the
       value. The bytes are messages the driver sent earlier on the same
       connection: SQL text and parameter values of recent statements, which on
       a pooled connection can come from other requests. Each padded value can
       carry up to 8192 bytes of this traffic, or 16320 bytes on a connection
       with GSS encryption. The padding happens when an application declares a
       length larger than the data it supplies, through
       PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy,
       PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The
       driver accepts these calls without an error. An attacker who can make
       the application store such a value and read it back can collect earlier
       traffic. Applications whose declared lengths always match their data are
       not affected. Versions 42.7.3 and earlier pad with zeros.
     + CVE-2026-107314: versions 42.7.11 through 42.7.13 enforce no restriction
       when the requireAuth connection property excludes all six authentication
       methods the driver knows, for example
       requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver
       then accepts any method the server asks for, including cleartext
       password authentication. A value without a method in it, such as
       requireAuth=, (a single comma), is affected the same way. An attacker
       positioned between the application and its server can ask for cleartext
       password authentication and receive the database password. A positive
       list such as requireAuth=scram-sha-256, and a partial exclusion such as
       requireAuth=!password,!md5, are enforced correctly. The property has no
       default value, so a deployment that does not set it is not affected.
       42.7.14 fixes the problem: such a connection is refused with SQLState
       08004, and a value without a method in it is rejected as invalid.
Checksums-Sha1:
 944da05a66bf5092fbe5345307a1aef2801681e9 2426 libpgjava_42.7.14-1.dsc
 522aed9be110272187ff0b7b7e5d771acbf6e3a0 1224149 libpgjava_42.7.14.orig.tar.gz
 98c9dda4625a12fac5174dce8a8a51037226d9ec 11764 libpgjava_42.7.14-1.debian.tar.xz
Checksums-Sha256:
 c14c83a5486cf4da479ddab38f3e3b21ac9cdea8f4d97175e5e8a7cef5b566e8 2426 libpgjava_42.7.14-1.dsc
 1f38e5e32f1e9b2200f6c0e7cce02d635d7bc14b35dff803a52e09cd666a16b9 1224149 libpgjava_42.7.14.orig.tar.gz
 5a614a21193cf7ffdfdaf334433307d3628cb10beddc02bd292fc3eb76da26ed 11764 libpgjava_42.7.14-1.debian.tar.xz
Files:
 086da6a46f697a8f81d33dc933aad648 2426 java optional libpgjava_42.7.14-1.dsc
 abe9eb01a66a7a2371e5eb154fd5fc93 1224149 java optional libpgjava_42.7.14.orig.tar.gz
 86e1b2fac82844b291ec4f280671fe72 11764 java optional libpgjava_42.7.14-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmrItU4ACgkQTFprqxLS
p663kQ//QCwMgWr+nYJT1ZbWlwjtGJKzcj8J0tYimgp2gxKZnpk4eIHP+6RLIqcq
293419kM3DUf1gq1pzhxHgwhO+NZQocYiDlUAojaa/4iJDGWKHKxGgMqCyD/DK57
UXKqx6jkYHC6Go6hzeLe6HEU8DgGHkOXUqyoNTZVxh6uJVlT9zTDHr9M0cPc70bP
76kNw9zhDizk9C8Eo7VAloK3E2vcag/mjE0Ceo7c5IU1YWHTB7PZk5uSyqNtb+B9
/A4E1s8aFO4+p9LrrPYKRE1wa4NPSKMuufHvpXCfnpCoFPVCxwiQLtl6GE9wrsvg
TU9YS+L+AuXdgTLyCyGebJLq5QOk8jyDHgCjqIwmFZrxqcEAFdljWbPMUkfXQ5Fq
KkJPjE9fJtg1MMIrU83jPK9KwRGjN06Xzcqcs8gW+bc2UZop8geuj19cHeZWQUaa
39IoXKo3N/1xE0xQz6I3OerV5ByXTS0VIg+z78LUgdD5YazQCtdU2RcKlxNAT5qD
l9UpphixHyKnZ2LBv6j0lnR8fvu4g7ZIUPR8KgGn88rDe1bCHHokAJaMgENg9eNM
tmcwUVb0rNFOYQRagJbO8WffINCRYv4Ms4LScGZox/CqmsNjd7zveZIiW8RM4hlk
HitTys285CMBtQ8PWHEFX5j3yym85p5Cva1SSIeKnX+guJTaZdo=
=bd+B
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261009/cb0c9dbb/attachment.sig>