A covert timing channel in PostgreSQL's MD5 password comparison (CVE-2026-6478, CVSS 6.5) allows for credential recovery. The vulnerability affects PostgreSQL versions prior to 14.23, 15.x prior to 15.18, 16.x prior to 16.14, 17.x prior to 17.10, and 18.x prior to 18.4. Red Hat has released an update for the postgresql:13 module in RHEL 8 to address this issue.
Errata des produits Red Hat RHSA-2026:28208 - Security Advisory Publié : 2026-06-23 Mis à jour : 2026-06-23 RHSA-2026:28208 - Security Advisory Aperçu général Paquets mis à jour Synopsis Important: postgresql:13 security update Type / Sévérité Security Advisory: Important Analyse des correctifs dans Red Hat Insights Identifiez et remédiez aux systèmes concernés par cette alerte. Voir les systèmes concernés Sujet An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Produits concernés Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Correctifs BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison CVE CVE-2026-6478 Références https://access.redhat.com/security/updates/classification/#important Remarque: Il existe peut-être des versions plus récentes de ces paquets. Cliquer sur un nom de paquet pour obtenir plus de détails. Red Hat Enterprise Linux for x86_64 8 SRPM pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.src.rpm SHA-256: 1005a0b4d3085f7df862ddb243f768265ddd36c23a475fda6110bb12dc04249a pgaudit-1.5.0-1.module+el8.9.0+20664+9c30cf7f.src.rpm SHA-256: eb175affc327a855cf7d59c627c7569f7096540245c499e5dee854a662c1b121 postgres-decoderbufs-0.10.0-2.module+el8.9.0+20664+9c30cf7f.src.rpm SHA-256: f470efe91fd4027218fb9bf67158c86f30c4b2dbb740c3b5e77c84a3b57dfc62 postgresql-13.23-3.module+el8.10.0+24363+8e5fd2e3.src.rpm SHA-256: c9e4e502629d0fe918bd155d9d90f8052f1a694f57f9bcbfd20665f01d83e9a3 x86_64 postgresql-test-rpm-macros-13.23-3.module+el8.10.0+24363+8e5fd2e3.noarch.rpm SHA-256: 9fbff7b3e1a98eb99e79bc09a513731ace7e49790fea3b9c134d86071523e466 postgresql-test-rpm-macros-13.23-3.module+el8.10.0+24363+8e5fd2e3.noarch.rpm SHA-256: 9fbff7b3e1a98eb99e79bc09a513731ace7e49790fea3b9c134d86071523e466 postgresql-test-rpm-macros-13.23-3.module+el8.10.0+24363+8e5fd2e3.noarch.rpm SHA-256: 9fbff7b3e1a98eb99e79bc09a513731ace7e49790fea3b9c134d86071523e466 pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: d191b4dc636dfe141b4a5cd2f30e1feb4ff759a200910ca7fdebb2fbd5dafbe7 pg_repack-debuginfo-1.4.6-3.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: e0887758f5d0e9f2131580ae1d652605ed514ed79e10b17639576da1de8b5c80 pg_repack-debugsource-1.4.6-3.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: 49516a4f82d919a72501ae5a97cd990c833bfd56a9a1481398caf8ccec79f185 pgaudit-1.5.0-1.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: 53c9a2746de5678bf1d10ed0243491577ea62657eac4ee0d00989794d0d4d4e9 pgaudit-debuginfo-1.5.0-1.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: af44fb4d4d87e5b049fd246660c09e82eb91ad785e12173ecee4b01dabad334e pgaudit-debugsource-1.5.0-1.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: 72d6049c9e87422738e5a844af63744bfbd3e02a5f4c30c64187e7bcdf9afa4a postgres-decoderbufs-0.10.0-2.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: d17ec600c122dbc108413785bfecbcee2c22217d6ccadfcdc16300dfcb15afb9 postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: 35020e22242c7fe411b5aaa432836b43307bcd12fc57a60280d7c77484fdc429 postgres-decoderbufs-debugsource-0.10.0-2.module+el8.9.0+20664+9c30cf7f.x86_64.rpm SHA-256: a176229b824e488fdf5dba3249fa3ba70bc4252f181e7f03589fa85c22f2fc11 postgresql-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 4b5f4c40d0a8deb1717452402a07806210e1f7dde326e3a021cdb0ef5be04c13 postgresql-contrib-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 3d9fc46415d8224afa7876162784cce9fd1aeeeee08a52027d417c405aaa7d86 postgresql-contrib-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: ecfb115f1b48016b5babdaf5220ead7e32707cfb8c65ad61f5ce5121b906b848 postgresql-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: ab5de6b11fd0961e84f80bca7391e0444c43690a511b1f8ce308ff71f2ab2d2c postgresql-debugsource-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 5daa8ba3c87a69d2e3103719b217d743b1da733fafdc17639c58c063f3873edd postgresql-docs-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 7c4a7fbb45f40db23eff8eb1083464e4c38d3d7838b173dac945ce42e60c25cc postgresql-docs-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 35b2cc25b8f24c211bf487a8e504712e2a5bfb81a48840a7fa7669208ba641b3 postgresql-plperl-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 13f43c8eaea37fe43d13092b87bac59e97d71d81a75b631ca1c0ce95616ff556 postgresql-plperl-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 26c487617899bd478132b1e79dea4cd121ebb94ccf86cfbda78ffe3778a1c949 postgresql-plpython3-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 5e8c606aaf336d8bdaa6692d8a43d87914d510ae66c05a3ed1e6594f2364bb21 postgresql-plpython3-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: e802f83c8a08716c9f180cd6eff573a080671714306ec7450a98f0bf4007d394 postgresql-pltcl-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 2291985a5a9184999bf44d337606c70f57130b1032f6c449f05b4d40d55c2fc1 postgresql-pltcl-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: d6302e010780256ae12969521d6f1e056cbdaf4b1034f98d1ffd83b25f1c6768 postgresql-server-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: f0a3403d77a5f0b60d5d5bf89146bba3befe273dfa3393ae9b7a0f2478ff7377 postgresql-server-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 34b4351faaf1ba3f189e1cde3dac5b98b55fc851ea7e56097e6ea2d281c9381d postgresql-server-devel-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 1eaf5142891a14247e24d94e5e520ad591fd8b1e9e217bf719e384bcc835d8fe postgresql-server-devel-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: ae052a5b1173770938e4aad497ad04ff65027f2dd979de6ba39c15c3f2beb31d postgresql-static-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 4bd4a137f5eb92c7c7a907d9491c0fa5f9f39da2dfed6ecd63a8fc8b4d1bcab8 postgresql-test-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: d9732a89d8d24621d0d83ddaa2289c60fbd46bf25cb8a03500e2e91b5435302c postgresql-test-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 382d715c88cc491c0b7e9c9c29b8d2f6f0ced22997614c02b4f54316a33b2bd1 postgresql-test-rpm-macros-13.23-3.module+el8.10.0+24363+8e5fd2e3.noarch.rpm SHA-256: 9fbff7b3e1a98eb99e79bc09a513731ace7e49790fea3b9c134d86071523e466 postgresql-upgrade-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: f6b6f46027d519759f4a0eb0db053da635c08f2d12900f4f51b8190059404411 postgresql-upgrade-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 489d1bccdfd7fef19950961b389898e25bae73b1a7caa425c9eb0a83de0a15c6 postgresql-upgrade-devel-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: 14add753e78cacd472d9447ba26dfe021934c58a40263fdc9cf486f2a43727bb postgresql-upgrade-devel-debuginfo-13.23-3.module+el8.10.0+24363+8e5fd2e3.x86_64.rpm SHA-256: bf6d6ac3c17069f06415cbd279f141dd994093c3bc829f29338f80f0411f0b97 Red Hat Enterprise Linux for IBM z Systems 8 SRPM pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.src.rpm SHA-256: 1005a0b4d3085f7df862ddb243f768265ddd36c23a475fda6110bb12dc04249a pgaudit-1.5.0-1.module+el8.9.0+20664+9c30cf7f.src.rpm SHA-256: eb175affc327a855cf7d59c627c7569f7096540245c499e5dee854a662c1b121 postgres-decoderbufs-0.10.0-2.module+el8.9.0+20664+9c30cf7f.src.rpm SHA-256: f470efe91fd4027218fb9bf67158c86f30c4b2dbb740c3b5e77c84a3b57dfc62 postgresql-13.23-3.module+el8.10.0+24363+8e5fd2e3.src.rpm SHA-256: c9e4e502629d0fe918bd155d9d90f8052f1a694f57f9bcbfd20665f01d83e9a3 s390x postgresql-test-rpm-macros-13.23-3.module+el8.10.0+24363+8e5fd2e3.noarch.rpm SHA-256: 9fbff7b3e1a98eb99e79bc09a513731ace7e49790fea3b9c134d86071523e466 postgresql-test-rpm-macros-13.23-3.module+el8.10.0+24363+8e5fd2e3.noarch.rpm SHA-256: 9fbff7b3e1a98eb99e79bc09a513731ace7e49790fea3b9c134d86071523e466 pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x.rpm SHA-256: dc6558310ee5ca4ba40088596504e6f73e935d2ade6e5fc4c957f3c66c5561ea pg_repack-debuginfo-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x.rpm SHA-256: 306c05a4c471a6c5e10d17d442a3face0d884e0714f192216ae64b298e24fd7e pg_repack-debugsource-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x.rpm SHA-256: ab049fd31d382622765b321014da57849d3db0570d04872d7fd86f5e73a85fe5 pgaudit-1.5.0-1.module+el8.9.0+20664+9c30cf7f.s390x.rpm SHA-256: 4c88e1b13602bf8d0ac49b864c64d1ce045334147a807fc9c15fe35963229fa2 pgaudit-debuginfo-1.5.0-1.module+el8.9.0+20664+9c30cf7f.s390x.rpm SHA-256: ab86e4411eb6e99433e12cedfc36a75608da03856d9157769e5f27243335ce2b pgaudit-debugsource-1.5.0-1.module+el8.9.0+20664+9c30cf7f.s390x.rpm SHA-256: 20ad5f8c81c8f536098584620d0783380f8b80fe4976b510e1b5a6d850328d9d postgres-decoderbufs-0.10.0-2.modul