PostgreSQL Covert Timing Channel Vulnerability in MD5 Password Authentication

A covert timing channel vulnerability has been identified in PostgreSQL authentication when comparing MD5-hashed passwords. This issue allows an attacker to recover user credentials sufficient for authentication. The vulnerability does not affect passwords hashed with scram-sha-256, which is the default in all supported PostgreSQL releases. However, databases upgraded from PostgreSQL 13 or earlier may still contain MD5-hashed passwords. Affected versions include those prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23.

Impact

Exploitation of this vulnerability allows for the recovery of MD5-hashed passwords, which can be used to authenticate as the corresponding user.

Remediation

Users can upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, or 14.23 to address this vulnerability.