BIT-postgresql-jdbc-driver-2025-49146

    Dashboard / Vulnerabilities / BIT-postgresql-jdbc-driver-2025-49146

    BIT-postgresql-jdbc-driver-2025-49146

    Published: 14 Jun 2025Last Modified: 10 Sept 2026

    Summary: pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

    Details: pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.

    References: https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0, https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54, https://nvd.nist.gov/vuln/detail/CVE-2025-49146

    Affected packages

    Package

    Name: postgresql-jdbc-driver

    Purl: pkg:bitnami/postgresql-jdbc-driver

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 42.7.4
    Fixed -42.7.7

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-postgresql-jdbc-driver-2025-49146 | CVE-DB