git: 36ee92b79b37 - main - security/vuxml: Document databases/postgresql-jdbc vulnerability

Go to: [ bottom of page ] [ top of archives ] [ this month ]

From: Palle Girgensohn <girgen_at_FreeBSD.org>
Date: Tue, 30 Jun 2026 11:12:17 UTC

The branch main has been updated by girgen:

URL: https://cgit.FreeBSD.org/ports/commit/?id=36ee92b79b37475f1cec98783f0f2b515f532b75

commit 36ee92b79b37475f1cec98783f0f2b515f532b75
Author:     Palle Girgensohn <girgen@FreeBSD.org>
AuthorDate: 2026-06-30 08:36:45 +0000
Commit:     Palle Girgensohn <girgen@FreeBSD.org>
CommitDate: 2026-06-30 11:11:40 +0000

    security/vuxml: Document databases/postgresql-jdbc vulnerability
---
 security/vuxml/vuln/2026.xml | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index 212ead859135..fba334322bca 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,40 @@
+  <vuln vid="7701f760-745c-11f1-bc50-6cc21735f730">
+    <topic>PostgresSQL JDBC -- Silent channel-binding authentication downgrade via unsupported certificate algorithms</topic>
+    <affects>
+      <package>
+	<name>postgresql-jdbc</name>
+	<range><lt>47.7.12</lt></range>
+	<range><ge>47.7.4</ge></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>PostgreSQL project reports:</p>
+	<blockquote cite="https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867">
+	  <p>
+	    channelBinding=require connections can be silently
+	    downgraded from SCRAM-SHA-256-PLUS (with channel
+	    binding) to plain SCRAM-SHA-256 (without it), losing the
+	    man-in-the-middle protection the setting is meant to
+	    guarantee. An attacker who can intercept the TLS
+	    connection triggers the downgrade with a certificate
+	    whose signature algorithm has no tls-server-end-point
+	    channel-binding hash. Examples are Ed25519, Ed448, and
+	    post-quantum algorithms.
+	  </p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2026-54291</cvename>
+      <url>https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867</url>
+    </references>
+    <dates>
+      <discovery>2026-06-30</discovery>
+      <entry>2026-06-30</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="5181294e-7471-11f1-8de5-a8a1599412c6">
     <topic>chromium -- security fixes</topic>
     <affects>