BSD PortsPostgreSQL JDBC library -- Improper Authentication
· CVE-2025-49146 · VuXML entry
PostgreSQL JDBC Driver project reports: Client Allows Fallback to Insecure Authentication Despite channelBinding=require configuration. Fix channel binding required handling to reject non-SASL authentication Previously, when channel binding was set to "require", the driver would silently ignore this requirement for non-SASL authentication methods. This could lead to a false sense of security when channel binding was …
Affected versions
- postgresql-jdbc < 42.7.7
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/postgresql-jdbc | 42.7.14 | fixed | (420 days after) |
| MidnightBSD | databases/postgresql-jdbc | 42.7.12_1 | out of range, by version | |
| DragonFly | databases/postgresql-jdbc | 42.7.5 | vulnerable since 2025-06-12 |