IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
4.2Orta

CVE-2026-14681PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL

PostgreSQL Yayım: (3 ay önce)

Açıklama

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

Zayıflık türü (CWE): CWE-924

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
postgresql postgresql 17.0 – < 17.11
— PostgreSQL 18 – < 18.6, 17 – < 17.11

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (2)
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 17.0 < 17.11
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* ≥ 18.0 < 18.5

Aynı üründe son açıklar — PostgreSQL

7.2Yüksek
CVE-2026-6471

PostgreSQL logical decoding can dlopen arbitrary file

PostgreSQL

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary co…

4.3Orta
CVE-2026-6470

PostgreSQL fails to check type USAGE privilege

PostgreSQL

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and r…