From fadbe882d16112fd8c5ccf2b73eb9621dbfe130a Mon Sep 17 00:00:00 2001 From: Nathan Bossart Date: Mon, 10 Aug 2026 06:38:24 -0700 Subject: [PATCH] Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration parameter instead, and document that unauthenticated users can discover the existence of roles with passwords created with different iteration counts. Reported-by: Radim Marek Author: Nathan Bossart Reviewed-by: Michael Paquier Reviewed-by: Heikki Linnakangas Reviewed-by: Jacob Champion Security: CVE-2026-14672 Backpatch-through: 16 --- doc/src/sgml/config.sgml | 13 +++++++++++++ src/backend/libpq/auth-scram.c | 2 +- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 3f8cd96d9a1..8a04cdfaaa1 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1136,6 +1136,19 @@ include_dir 'conf.d' time of encryption. In order to make use of a changed value, a new password must be set. + + + If a role password was created with a different iteration count than + the value of scram_iterations specified in the + postgresql.conf file or on the server command + line, an unauthenticated user can discern the existence of the role by + observing discrepancies in the server's responses to connection + attempts. If you find this concerning, ensure that all role passwords + are created with scram_iterations set to the value + specified in the postgresql.conf file or on the + server command line. + + diff --git a/src/backend/libpq/auth-scram.c b/src/backend/libpq/auth-scram.c index 1b9e1cc0cc1..ce9f4ba5eb8 100644 --- a/src/backend/libpq/auth-scram.c +++ b/src/backend/libpq/auth-scram.c @@ -722,7 +722,7 @@ mock_scram_secret(const char *username, pg_cryptohash_type *hash_type, encoded_salt[encoded_len] = '\0'; *salt = encoded_salt; - *iterations = SCRAM_SHA_256_DEFAULT_ITERATIONS; + *iterations = scram_sha_256_iterations; /* StoredKey and ServerKey are not used in a doomed authentication */ memset(stored_key, 0, SCRAM_MAX_KEY_LEN);