Index: vuln.xml =================================================================== --- vuln.xml (revision 396449) +++ vuln.xml (working copy) @@ -58,6 +58,37 @@ --> + + pgbouncer -- failed auth_query lookup leads to connection as auth_user + + + pgbouncer + 1.6.0 + + + + +

PgBouncer reports:

+
New auth_user functionality introduced in 1.6 allows login as + auth_user when client presents unknown username. It's quite likely + auth_user is superuser. Affects only setups that have enabled + auth_user in their config.
+

+ + + + CVE-2015-6817 + https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/ + https://github.com/pgbouncer/pgbouncer/issues/69 + http://www.openwall.com/lists/oss-security/2015/09/04/3 + + + 2015-09-03 + 2015-09-09 + + + phpMyAdmin -- reCaptcha bypass