CyberRota Analysis
AI-GeneratedPostgreSQL versions 16-18, specifically minor versions prior to 18.5, 17.11, and 16.15, are vulnerable due to a discrepancy in SCRAM authentication response that allows unauthenticated users to infer the existence of a user based on the SCRAM iteration count. This vulnerability poses a medium risk as it could facilitate targeted attacks against user accounts with non-default scram_iterations settings. Database administrators and security teams managing affected PostgreSQL versions should prioritize applying the necessary updates to mitigate this risk.
Original NVD Description
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
Related CVEs
Other vulnerabilities affecting the same vendor(s)