Dependency: pgx v5.9.2 vulnerable to auth downgrade (CWE-306, fix in v5.10.0)

[canolgun]

Supply-chain notification

This project depends on jackc/pgx v5.9.2 which is vulnerable to CWE-306 (Missing Authentication Method Restriction).

Vulnerability: A malicious PostgreSQL server can downgrade authentication to cleartext password by sending AuthenticationCleartextPassword, which pgx < v5.10.0 accepts unconditionally.

Fix: pgx v5.10.0 adds require_auth config option restricting accepted auth methods (commit 1a976f7b).

Remediation: Bump github.com/jackc/pgx/v5 to v5.10.0+

• CWE: CWE-306
• CVSS: 7.5 (High)
• Upstream fix: jackc/pgx@1a976f7bb9
• Advisory: GHSA-gjrm-8jwf-89gx

Found by bounty-hunter v6.0