Weak password requirements in pgbouncer - CVE-2025-2291

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU107593

Weak password requirements in pgbouncer - CVE-2025-2291

Published: April 17, 2025


Vulnerability identifier: #VU107593
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-2291
CWE-ID: CWE-521
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an attacker to gain unauthorized access to the application.

The vulnerability exists due to password can be used past its expiration as auth_query is not taking into account Postgre's VALID UNTIL value. An attacker with knowledge of an expired password can successfully login to the application.


Affected software

pgbouncer
Fedora
pgbouncer

How to mitigate CVE-2025-2291

Install updates from vendor's website.

pgbouncer - update to 1.24.1
pgbouncer - addressed in versions 1.24.1-1.el9, 1.24.1-2.el8, 1.24.1-2.el10_1, 1.24.1-2.fc40, 1.24.1-2.fc41, 1.24.1-2.fc42

External References

Related Security Bulletins