PgBouncer Password Expiry Bypass Vulnerability

A vulnerability in PgBouncer allows passwords to be used after their expiration date. This issue arises because the 'auth_query' does not consider the 'VALID UNTIL' value of passwords in PostgreSQL. As a result, an attacker can log in with an expired password. This vulnerability affects PgBouncer versions 1.0.0 through 1.24.0.

Impact

Exploitation of this vulnerability allows users to authenticate with expired passwords, potentially leading to unauthorized access.

Remediation

Users can upgrade to PgBouncer version 1.24.1, which addresses this vulnerability by updating the default 'auth_query' to consider password expiration. Those using a custom 'auth_query' should modify it to account for the 'VALID UNTIL' value.