Bug 2477447 (CVE-2026-6478) - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison
Summary: CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing c...
Keywords:
Status: NEW
Alias: CVE-2026-6478
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2482516 2482517 2482518 2482515
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-14 14:02 UTC by OSIDB Bzimport
Modified: 2026-07-23 11:55 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:26181 0 None None None 2026-06-16 07:44:52 UTC
Red Hat Product Errata RHSA-2026:26203 0 None None None 2026-06-16 11:49:46 UTC
Red Hat Product Errata RHSA-2026:26204 0 None None None 2026-06-16 11:50:00 UTC
Red Hat Product Errata RHSA-2026:26524 0 None None None 2026-06-17 07:50:43 UTC
Red Hat Product Errata RHSA-2026:26525 0 None None None 2026-06-17 08:40:50 UTC
Red Hat Product Errata RHSA-2026:26561 0 None None None 2026-06-17 11:51:49 UTC
Red Hat Product Errata RHSA-2026:27718 0 None None None 2026-06-22 05:46:04 UTC
Red Hat Product Errata RHSA-2026:27738 0 None None None 2026-06-22 05:28:09 UTC
Red Hat Product Errata RHSA-2026:27741 0 None None None 2026-06-22 06:05:56 UTC
Red Hat Product Errata RHSA-2026:27742 0 None None None 2026-06-22 05:48:12 UTC
Red Hat Product Errata RHSA-2026:27743 0 None None None 2026-06-22 05:44:48 UTC
Red Hat Product Errata RHSA-2026:28037 0 None None None 2026-06-22 19:51:00 UTC
Red Hat Product Errata RHSA-2026:28143 0 None None None 2026-06-23 10:03:06 UTC
Red Hat Product Errata RHSA-2026:28208 0 None None None 2026-06-23 13:19:41 UTC
Red Hat Product Errata RHSA-2026:28999 0 None None None 2026-06-24 13:39:04 UTC
Red Hat Product Errata RHSA-2026:29212 0 None None None 2026-06-25 02:33:22 UTC
Red Hat Product Errata RHSA-2026:29815 0 None None None 2026-06-25 10:29:30 UTC
Red Hat Product Errata RHSA-2026:29904 0 None None None 2026-06-25 12:20:46 UTC
Red Hat Product Errata RHSA-2026:29953 0 None None None 2026-06-25 15:04:57 UTC
Red Hat Product Errata RHSA-2026:32983 0 None None None 2026-06-29 11:55:14 UTC
Red Hat Product Errata RHSA-2026:32994 0 None None None 2026-06-29 12:16:16 UTC
Red Hat Product Errata RHSA-2026:33441 0 None None None 2026-06-30 08:52:12 UTC
Red Hat Product Errata RHSA-2026:33497 0 None None None 2026-06-30 12:47:17 UTC
Red Hat Product Errata RHSA-2026:34043 0 None None None 2026-07-01 06:32:55 UTC
Red Hat Product Errata RHSA-2026:34362 0 None None None 2026-07-01 18:16:19 UTC
Red Hat Product Errata RHSA-2026:34363 0 None None None 2026-07-01 18:15:56 UTC
Red Hat Product Errata RHSA-2026:35880 0 None None None 2026-07-06 09:48:38 UTC
Red Hat Product Errata RHSA-2026:42555 0 None None None 2026-07-21 06:32:57 UTC
Red Hat Product Errata RHSA-2026:44420 0 None None None 2026-07-23 11:55:59 UTC

Description OSIDB Bzimport 2026-05-14 14:02:08 UTC 
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.  This does not affect scram-sha-256 passwords, the default in all supported releases.  However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Comment 3 errata-xmlrpc 2026-06-16 07:44:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:26181 https://access.redhat.com/errata/RHSA-2026:26181
Comment 4 errata-xmlrpc 2026-06-16 11:49:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:26203 https://access.redhat.com/errata/RHSA-2026:26203
Comment 5 errata-xmlrpc 2026-06-16 11:49:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:26204 https://access.redhat.com/errata/RHSA-2026:26204
Comment 6 errata-xmlrpc 2026-06-17 07:50:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:26524 https://access.redhat.com/errata/RHSA-2026:26524
Comment 7 errata-xmlrpc 2026-06-17 08:40:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:26525 https://access.redhat.com/errata/RHSA-2026:26525
Comment 8 errata-xmlrpc 2026-06-17 11:51:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:26561 https://access.redhat.com/errata/RHSA-2026:26561
Comment 9 errata-xmlrpc 2026-06-22 05:28:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:27738 https://access.redhat.com/errata/RHSA-2026:27738
Comment 10 errata-xmlrpc 2026-06-22 05:44:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:27743 https://access.redhat.com/errata/RHSA-2026:27743
Comment 11 errata-xmlrpc 2026-06-22 05:46:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:27718 https://access.redhat.com/errata/RHSA-2026:27718
Comment 12 errata-xmlrpc 2026-06-22 05:48:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:27742 https://access.redhat.com/errata/RHSA-2026:27742
Comment 13 errata-xmlrpc 2026-06-22 06:05:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:27741 https://access.redhat.com/errata/RHSA-2026:27741
Comment 14 errata-xmlrpc 2026-06-22 19:50:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:28037 https://access.redhat.com/errata/RHSA-2026:28037
Comment 15 errata-xmlrpc 2026-06-23 10:03:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:28143 https://access.redhat.com/errata/RHSA-2026:28143
Comment 16 errata-xmlrpc 2026-06-23 13:19:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:28208 https://access.redhat.com/errata/RHSA-2026:28208
Comment 17 errata-xmlrpc 2026-06-24 13:39:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:28999 https://access.redhat.com/errata/RHSA-2026:28999
Comment 18 errata-xmlrpc 2026-06-25 02:33:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:29212 https://access.redhat.com/errata/RHSA-2026:29212
Comment 19 errata-xmlrpc 2026-06-25 10:29:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:29815 https://access.redhat.com/errata/RHSA-2026:29815
Comment 20 errata-xmlrpc 2026-06-25 12:20:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:29904 https://access.redhat.com/errata/RHSA-2026:29904
Comment 21 errata-xmlrpc 2026-06-25 15:04:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:29953 https://access.redhat.com/errata/RHSA-2026:29953
Comment 22 errata-xmlrpc 2026-06-29 11:55:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:32983 https://access.redhat.com/errata/RHSA-2026:32983
Comment 23 errata-xmlrpc 2026-06-29 12:16:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:32994 https://access.redhat.com/errata/RHSA-2026:32994
Comment 24 errata-xmlrpc 2026-06-30 08:52:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:33441 https://access.redhat.com/errata/RHSA-2026:33441
Comment 25 errata-xmlrpc 2026-06-30 12:47:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:33497 https://access.redhat.com/errata/RHSA-2026:33497
Comment 26 errata-xmlrpc 2026-07-01 06:32:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:34043 https://access.redhat.com/errata/RHSA-2026:34043
Comment 27 errata-xmlrpc 2026-07-01 18:15:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:34363 https://access.redhat.com/errata/RHSA-2026:34363
Comment 28 errata-xmlrpc 2026-07-01 18:16:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:34362 https://access.redhat.com/errata/RHSA-2026:34362
Comment 29 errata-xmlrpc 2026-07-06 09:48:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:35880 https://access.redhat.com/errata/RHSA-2026:35880
Comment 30 errata-xmlrpc 2026-07-21 06:32:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:42555 https://access.redhat.com/errata/RHSA-2026:42555
Comment 31 errata-xmlrpc 2026-07-23 11:55:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:44420 https://access.redhat.com/errata/RHSA-2026:44420
Note You need to log in before you can comment on or make changes to this bug.