BSD PortsPostgresSQL JDBC -- Silent channel-binding authentication downgrade via unsupported certificate algorithms
· CVE-2026-54291 · VuXML entry
PostgreSQL project reports: channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. …
Affected versions
- postgresql-jdbc >= 47.7.4 < 47.7.12
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/postgresql-jdbc | 42.7.14 | fixed | (37 days after) |
| MidnightBSD | databases/postgresql-jdbc | 42.7.12_1 | out of range, by version | |
| DragonFly | databases/postgresql-jdbc | 42.7.5 | fixed |