Postgresql:12 Security Update — AlmaLinux 8 (ALSA-2026:28999)

ALSA-2026:28999 updates PostgreSQL 12 on AlmaLinux 8, fixing two flaws: credential recovery via a covert timing channel in MD5 password comparison (CVE-2026-6478) and a second issue (CVE-2026-6473), aggregate CVSS 6.5 with CWE-385 (covert channel) among them. The practical fix beyond updating is disabling MD5 authentication in favor of scram-sha-256: dnf update postgresql and switch password_encryption.

High 6.5 CVSS 2026-10-26

AlmaLinux 8

SharedLicense लाइसेंस के तहत इसका अर्थ

A timing side channel in password comparison lets a network observer recover credentials byte by byte — on an internet-exposed PostgreSQL port, that is a quiet path to database access.

Type:

security

Severity:

important

Release date:

2026-10-26

Description:

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

* postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
* postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	pgaudit-1.4.0-7.module_el8.10.0+3889+48cb11fb.alma.1.aarch64.rpm	8e29d61d3231b1e12894ddc5a5e2c015291450ca149ec9ddf4cf98a67be2c994
aarch64	pg_repack-1.4.6-3.module_el8.9.0+3704+f1f917ce.aarch64.rpm	d387f0b4763bd897b8b7fb5e17c9c3614c6e23159b77e886164725f79f82cd13
aarch64	postgres-decoderbufs-0.10.0-2.module_el8.9.0+3704+f1f917ce.aarch64.rpm	eaa32eea438e859ac3104060c211187f53da746e219021535b66046809df054d
ppc64le	pg_repack-1.4.6-3.module_el8.9.0+3704+f1f917ce.ppc64le.rpm	0d8ef1ab493c2ac3716bff9672c30cf30ec7561f8bb9fdf63ddeea22f5799426
ppc64le	postgres-decoderbufs-0.10.0-2.module_el8.9.0+3704+f1f917ce.ppc64le.rpm	747294e7a6924a34ad2b2223f2c8411a69f9dab6a120433af7e72b68f2714a45
ppc64le	pgaudit-1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1.ppc64le.rpm	d35f381e2b4743a54701b9286c07d3e6300bd8ec3e5acc66430ed9bbcab16e57
s390x	pgaudit-1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1.s390x.rpm	05a6d09d675776fb9ab998aa9fb52890d6c4ecc40957331844fd2c42f555ebca
s390x	pg_repack-1.4.6-3.module_el8.9.0+3704+f1f917ce.s390x.rpm	14fdf29fe5dd7075aaf956b75aec2c5028f78ea8c06a19b461fa970284284047
s390x	postgres-decoderbufs-0.10.0-2.module_el8.9.0+3704+f1f917ce.s390x.rpm	8cd16a1e3af9b7e12bf6df8db5735aeeb762e32913e95ec5dabcb05c6ac34f39
x86_64	pgaudit-1.4.0-7.module_el8.10.0+3889+48cb11fb.alma.1.x86_64.rpm	669123aad2754ae8a52788cc4749307a85123933f5aa766784de4dab70ef22b3
x86_64	pg_repack-1.4.6-3.module_el8.9.0+3704+f1f917ce.x86_64.rpm	79b1ee8a01d145e00f93816e22ee5b777279d667c4c7d4f068951669fbb5acce
x86_64	postgres-decoderbufs-0.10.0-2.module_el8.9.0+3704+f1f917ce.x86_64.rpm	a8d19208b505cfbbc7ecc872d442b5a099decece96f97199f82018ae38718267

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

अक्सर पूछे जाने वाले प्रश्न

What is CVE-2026-6478?

It is a covert-timing-channel flaw (CWE-385) in PostgreSQL's MD5 password comparison: response timing differences leak information that allows credential recovery. Fixed alongside CVE-2026-6473 in the postgresql:12 module update ALSA-2026:28999 (aggregate CVSS 6.5).

Who is affected?

AlmaLinux 8 servers running the PostgreSQL 12 module with MD5 password authentication enabled — especially those accepting remote connections. MD5 is legacy; scram-sha-256 is the modern default.

How do I apply the fix?

Run dnf update postgresql (12 module), restart PostgreSQL — then harden authentication: set password_encryption = 'scram-sha-256', reset user passwords so they re-hash to SCRAM, and switch pg_hba.conf entries from md5 to scram-sha-256.

Why switch away from MD5 if the update fixes the flaw?

The update closes this specific timing leak, but MD5 challenge-response remains structurally weaker than SCRAM (it is replayable in some configurations). Moving to scram-sha-256 removes the whole class rather than this instance.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें

अक्सर पूछे जाने वाले प्रश्न

संबंधित सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें