Denial of Service in pgjdbc via SCRAM-SHA-256 Authentication

Executive Summary

This vulnerability affects the pgjdbc PostgreSQL JDBC Driver versions from 42.2.0 up to but not including 42.7.11. It is a client-side denial of service issue that occurs during SCRAM-SHA-256 authentication. A malicious server can cause the client to perform SCRAM authentication with an extremely large iteration count, which forces the client to spend an unbounded amount of CPU time computing PBKDF2 before the authentication fails.

Because of this, a single authentication attempt can tie up a CPU core, and repeated or concurrent attempts can exhaust the client's CPU resources and cause connection pools to become unresponsive. The loginTimeout setting does not fully mitigate this issue because even after the timeout expires, the worker thread performing the authentication continues to consume CPU.

This vulnerability was fixed in version 42.7.11 of the pgjdbc driver.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as excessive CPU usage on the client side during SCRAM-SHA-256 authentication with PostgreSQL servers. Detection involves monitoring CPU usage spikes on systems running affected pgjdbc versions when connecting to PostgreSQL servers.

Since the vulnerability is triggered by a malicious server specifying a very large PBKDF2 iteration count, you can detect suspicious authentication attempts by analyzing connection logs or network traffic for unusual SCRAM authentication parameters.

There are no specific commands provided in the resources to detect this vulnerability directly, but general approaches include:

• Monitor CPU usage on clients running pgjdbc versions between 42.2.0 and before 42.7.11 during database connection attempts.
• Inspect PostgreSQL server logs or network captures for SCRAM-SHA-256 authentication exchanges with unusually high iteration counts.
• Use system monitoring tools (e.g., top, htop on Linux) to identify processes consuming excessive CPU during authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service on the client side by exhausting CPU resources during the authentication process. Specifically, a malicious PostgreSQL server can force the client to perform expensive computations that consume a CPU core indefinitely.

As a result, your application or service using the affected pgjdbc driver may experience degraded performance, unresponsive connection pools, or complete inability to establish new database connections.

This can lead to service disruptions, increased latency, and potential downtime until the issue is resolved or the driver is updated to a patched version.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in pgjdbc allows a malicious server to cause a client-side denial of service by forcing excessive CPU usage during SCRAM-SHA-256 authentication. This results in availability issues due to CPU exhaustion and potential connection pool wedging.

While this impacts the availability aspect of systems using the affected driver versions, there is no direct information indicating an impact on confidentiality or integrity of data.

Therefore, this vulnerability could affect compliance with standards and regulations that require maintaining system availability, such as HIPAA's availability requirements or GDPR's requirement to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems. However, no explicit linkage to compliance impact is provided.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the pgjdbc PostgreSQL JDBC Driver to version 42.7.11 or later, where the issue has been patched.

Note that the loginTimeout setting does not fully mitigate the problem, as the worker thread performing the connection attempt may continue consuming CPU even after timeout.

Useful 0 Not Useful 0