From dec60e8ada4cd46d0201efea844a4b22cb06444e Mon Sep 17 00:00:00 2001 From: Nathan Bossart Date: Mon, 10 Aug 2026 06:38:18 -0700 Subject: [PATCH] Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek Author: Nathan Bossart Reviewed-by: Michael Paquier Reviewed-by: Heikki Linnakangas Reviewed-by: Jacob Champion Security: CVE-2026-14672 Backpatch-through: 16 --- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 8ab587cf37c..62637b13261 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1144,6 +1144,19 @@ include_dir 'conf.d' time of encryption. In order to make use of a changed value, a new password must be set. + + + If a role password was created with a different iteration count than + the value of scram_iterations specified in the + postgresql.conf file or on the server command + line, an unauthenticated user can discern the existence of the role by + observing discrepancies in the server's responses to connection + attempts. If you find this concerning, ensure that all role passwords + are created with scram_iterations set to the value + specified in the postgresql.conf file or on the + server command line. + + diff --git a/src/backend/libpq/auth-scram.c b/src/backend/libpq/auth-scram.c index b634c0573b8..ca0e1db950a 100644 --- a/src/backend/libpq/auth-scram.c +++ b/src/backend/libpq/auth-scram.c @@ -715,7 +715,7 @@ mock_scram_secret(const char *username, pg_cryptohash_type *hash_type, encoded_salt[encoded_len] = '\0'; *salt = encoded_salt; - *iterations = SCRAM_SHA_256_DEFAULT_ITERATIONS; + *iterations = scram_sha_256_iterations; /* StoredKey and ServerKey are not used in a doomed authentication */ memset(stored_key, 0, SCRAM_MAX_KEY_LEN);