PT-2025-16876 · Pgbouncer+4 · Pgbouncer+4

Published 2025-04-15 · Updated 2025-06-19 · CVE-2025-2291

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.24.1

Description The issue allows an attacker to log in with an already expired password due to PgBouncer's auth query not considering Postgres's VALID UNTIL value. This enables the use of passwords past their expiry date.

Recommendations For versions prior to 1.24.1, update to version 1.24.1 to resolve the issue. As a temporary workaround, consider restricting access to the auth query function until the update is applied.

Fix

Weakness Enumeration

CWE-324

Related Identifiers

ALT-PU-2025-6604

ALT-PU-2025-6618

ALT-PU-2025-6834

AZL-60437

AZL-60438

BDU:2025-07307

BIT-PGBOUNCER-2025-2291

CVE-2025-2291

DLA-4180-1

Affected Products

Alt Linux

Astra Linux

Debian

Pgbouncer

Red Os

References · 26

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2291 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2291 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2291 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pgbouncer-2025-2291 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2291 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2291 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4180-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60438 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2291 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60437 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07307 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2291 · Security Note