-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 02 Oct 2026 10:06:02 +0200 Source: pgpool2 Architecture: source Version: 4.7.3-1 Distribution: unstable Urgency: medium Maintainer: Debian PostgreSQL Maintainers <team+postgresql@tracker.debian.org> Changed-By: Christoph Berg <myon@debian.org> Closes: 1149670 Changes: pgpool2 (4.7.3-1) unstable; urgency=medium . * New upstream version 4.7.3. (Closes: #1149670) * CVE-2026-92867: An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution. * CVE-2026-92868: An improper certificate validation vulnerability exists in Pgpool- II, which may allow an unauthenticated attacker to bypass client certificate authentication. * CVE-2026-92869: An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination. * CVE-2026-92870: A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination. * CVE-2026-92871: A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process. * CVE-2026-92872: Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information. * CVE-2026-92873: Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node. Checksums-Sha1: 9aff0d18dda574d800a79e64567ddce9ef0819f8 2645 pgpool2_4.7.3-1.dsc 0e2b51b7e673ce90ba53e47f412bdf332634e6d6 5850112 pgpool2_4.7.3.orig.tar.gz fdf38fe5ce1439b584fb50d5421d40622b8667a8 15008 pgpool2_4.7.3-1.debian.tar.xz Checksums-Sha256: 787562ba1f7b5ab05d7f491b89d884505e29b6abc8f6c3b8c05796f68e0000bc 2645 pgpool2_4.7.3-1.dsc 4bf9df3e13feb8e64bee486b4ea54c9076296c2d9406165b0b68d32086fce250 5850112 pgpool2_4.7.3.orig.tar.gz 219e85b431e4f1bf9e8d9d581facc400e611ea2a3737b82deb36b258895ab4f4 15008 pgpool2_4.7.3-1.debian.tar.xz Files: b09e925887152d1d70abee7451ab8397 2645 database optional pgpool2_4.7.3-1.dsc 782c956c3d998b9017133cc2fe3b8240 5850112 database optional pgpool2_4.7.3.orig.tar.gz 59d578aa782ce5314d33ca37b04e4f91 15008 database optional pgpool2_4.7.3-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmq/cvIACgkQTFprqxLS p64Rlw/+K402uiudK1cTCQA+6wx1y0SM6SDRzcQt/xbDubOlmDN5ANFj6e2ZW347 dpFm0iXx0ThiaDQzrlYGhtyDM3EdBzHft7XMmDzWgTLBMi/RqhW8en6EghXzbafV 35+hz9oOKr4JYE7tzSNsWD2Pvq8565P3aj5iRtgKZ00jt5niaf9tdok7tdZ/MgTR 27+tlF7r2+E0h63vLJqO+uanloKsF/rwf6ldSHk0My6t2z4AmpqM1Iw0m18z+jjB MtSFkpSQhYpArIOmTzp+RxetopQ1PklX2Xd2JdyvMdYWVFtfvvIFPg8riEilqKQJ VBflgcumgU52jqN2Vj9v8zKJBBxAFTeqyDZLFKNXQXd7T6gEpppqjOsGruVXoKVb IrGt22XKnLEN4V1qoNLTq9Ef5h+I2xUfOF1cj5Oy+/BLt3KGjA6OXXfs1L3cpaIm xsC9sngBJ7xrD4wnpv7w8VUCs7Z4WIj0fkrhi6vreP+T8C7UJkc+hG8rN3iSa0oS RMJAohuOniy0U4n24npIfjUPJQWiGhP+4mj3V7QAUZOouWG/SGuaNDeOSUYey96H auUi61kNmMy/Yv+dkG1V4+pPBpkYCTvGnqeV5HL/CkVHs0XoK5efYHLUG2Q7617B kILuOmLU8NGCHKNN6EngtBYfykzvpKqgnOZMUD7d0AXVoEIgcDM= =avBm -----END PGP SIGNATURE-----
