Update dependency org.postgresql:postgresql to v42.7.11#51
Open
dev-mend-for-github-com[bot] wants to merge 1 commit into
Open
Update dependency org.postgresql:postgresql to v42.7.11#51dev-mend-for-github-com[bot] wants to merge 1 commit into
dev-mend-for-github-com[bot] wants to merge 1 commit into
Conversation
dev-mend-for-github-com
Bot
added
the
security fix
dev-mend-for-github-com
Bot
force-pushed
the
whitesource-remediate/org.postgresql-postgresql-42.x
branch
from
ce5b434 to
2434907
Compare
dev-mend-for-github-com
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
42.6.0→42.7.11By merging this PR, the below vulnerabilities will be automatically resolved:
Release Notes
pgjdbc/pgjdbc (org.postgresql:postgresql)
v42.7.11Security
pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
See the Security Advisory for more detail.
The following CVE-2026-42198 has been issued.
Added
Changed
Fixed
v42.7.10Changed
Fixed
Reverted
v42.7.9Added
Changed
Fixed
v42.7.8Added
Changed
BufferedInputStreamwithFileInputStreamPR #3750Fixed
v42.7.7Security
Fix
channel binding requiredhandling to reject non-SASL authenticationPreviously, when channel binding was set to "require", the driver would silently ignore this
requirement for non-SASL authentication methods. This could lead to a false sense of security
when channel binding was explicitly requested but not actually enforced. The fix ensures that when
channel binding is set to "require", the driver will reject connections that use
non-SASL authentication methods or when SASL authentication has not completed properly.
See the Security Advisory for more detail. Reported by George MacKerron
The following CVE-2025-49146 has been issued
Added
v42.7.6Features
Performance Improvements
v42.7.5Added
Fixed
fc60537PR #3476v42.7.4Added
Fixed
Deprecated
v42.7.3Changed
Fixed
else iftoswitchNoSuchMethodError on ByteBuffer#positionwhen running on Java 8v42.7.2Security
SimpleQuerymode to generate a line comment by having a placeholder for a numeric with a-such as
-?. There must be second placeholder for a string immediately after. Setting the parameter to a -ve value creates a line comment.This has been fixed in this version fixes CVE-2024-1597. Reported by Paul Gerste. See the security advisory for more details. This has been fixed in versions 42.7.2, 42.6.1 42.5.5, 42.4.4, 42.3.9, 42.2.28.jre7. See the security advisory for work arounds.
Changed
Added
v42.7.1Security
Added
autosave=ALWAYS. Controlled by the newflushCacheOnDdlconnection property (defaulttrue); set tofalsefor the prior behaviour.connectExecutorconnection property to customize theExecutorused to run the worker task that performs the connection attempt whenloginTimeoutis in effect. The value is the fully qualified name of a class implementingjava.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named"PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it.connectThreadFactoryconnection property to customize theThreadFactoryused to spawn the worker thread that runs the connection attempt whenloginTimeoutis in effect. The value is the fully qualified name of a class implementingjava.util.concurrent.ThreadFactory. With a null value, the default, the driver retains the prior behavior of using a daemon thread named"PostgreSQL JDBC driver connection thread". Useful for testing timeout behaviour or for applications that want detailed control of all driver-created threads.classLoaderStrategyconnection property to control which classloaders the driver searches when loading a class named by a connection property, for examplesocketFactory. The defaultdriver-firstnow falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Setdriverto keep the previous driver-classloader-only behaviour, orcontext-firstto prefer the thread context classloader Issue #2112Changed
loginTimeoutis now aFutureTask(ConnectTask) instead of the hand-rolledConnectThread. When the caller hits the timeout, the task is now cancelled withcancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, sologinTimeoutcan stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out.PGXAConnection.ConnectionHandlernow rejectssetAutoCommit(false)andsetSavepoint(...)during an active XA branch, in addition to the long-rejectedsetAutoCommit(true)/commit()/rollback(). ThesetSavepointrejection was already meant to be in place but the guard misspelled the method name assetSavePoint, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4.commitPrepared/rollback-of-prepared now returnXAER_RMFAILinstead ofXAER_RMERRwhen the underlying connection is left in a non-idleTransactionState. Transaction managers (Geronimo, Narayana, Atomikos) treatXAER_RMFAILas retryable on a freshXAResource; the prepared transaction is no longer abandoned.Fixed
contextClassLoaderof sharedForkJoinPool.commonPool()worker threads, which previously left unrelated tasks on those threads running with anullclassloader Issue #4155PGXAConnectionno longer saves and restores the underlying connection's JDBCautoCommitflag. All XA-protocol SQL (BEGIN,PREPARE TRANSACTION,COMMIT,ROLLBACK,COMMIT PREPARED,ROLLBACK PREPARED, therecover()SELECT) is sent throughQUERY_SUPPRESS_BEGIN, so the caller'sautoCommitvalue is invariant across everyXAResourcecall. Fixes the "2nd phase commit must be issued using an idle connection" failure during recovery on managed datasources that pool connections withautoCommit=false(TomEE, WildFly, WebSphere Liberty).PGXAConnection.prepare()now mutates XA state only afterPREPARE TRANSACTIONsucceeds. A failedPREPAREpreviously left the driver thinking the branch was already prepared, so the follow-uprollback(xid)triedROLLBACK PREPAREDagainst a non-existent gid and returnedXAER_RMERR. Transaction managers (Narayana) escalated this toHeuristicMixedException. With the fix,rollback(xid)takes the active-branch path and issues a plainROLLBACK, which the server accepts cleanly. Fixes Issue #3153, Issue #3123.v42.7.0Changed
java.desktopmodule. PR #2967Fixed