Wind River Support Network

HomeDefectsLIN1024-21268

Acknowledged

LIN1024-21268 : Security Advisory - postgresql - CVE-2026-6478

Created: May 15, 2026 Updated: Jun 3, 2026

Found In Version: 10.24.33.2

Severity: Standard

Applicable for: Wind River Linux LTS 24

Component/s: Userspace

Description

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.  This does not affect scram-sha-256 passwords, the default in all supported releases.  However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.