pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements. This vulnerability is fixed in 42.7.7.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101842 advisory.

  - pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC     driver is configured with channel binding set to required (default value is prefer), the driver would     incorrectly allow connections to proceed with authentication methods that do not support channel binding     (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to     intercept connections that users believed were protected by channel binding requirements. This     vulnerability is fixed in 42.7.7. (CVE-2025-49146)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC
    driver is configured with channel binding set to required (default value is prefer), the driver would
    incorrectly allow connections to proceed with authentication methods that do not support channel binding
    (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to
    intercept connections that users believed were protected by channel binding requirements. This
    vulnerability is fixed in 42.7.7. (CVE-2025-49146)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC     driver is configured with channel binding set to required (default value is prefer), the driver would     incorrectly allow connections to proceed with authentication methods that do not support channel binding     (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to     intercept connections that users believed were protected by channel binding requirements. This     vulnerability is fixed in 42.7.7. (CVE-2025-49146)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2a220a73-4759-11f0-a44a-6cc21735f730 advisory.

    PostgreSQL JDBC Driver project reports:

            Client Allows Fallback to Insecure Authentication Despite             channelBinding=require configuration. Fix channel binding             required handling to reject non-SASL authentication Previously,             when channel binding was set to require, the driver             would silently ignore this requirement for non-SASL             authentication methods. This could lead to a false sense of             security when channel binding was explicitly requested but not             actually enforced. The fix ensures that when channel binding is             set to require, the driver will reject connections that use             non-SASL authentication methods or when SASL authentication has             not completed properly.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298043	Atlassian Confluence 9.2.8 < 9.2.11 (CONFSERVER-101842)	Nessus	CGI abuses	medium
437067	SCA: security update for org.postgresql:postgresql (GHSA-hq9p-pm7w-8p54)	Tenable Cloud Security	SCA Checks	medium
437067	SCA: security update for org.postgresql:postgresql (GHSA-hq9p-pm7w-8p54)	Tenable Self-Hosted Container Security	SCA Checks	medium
244103	Linux Distros Unpatched Vulnerability : CVE-2025-49146	Nessus	Misc.	medium
238440	FreeBSD : PostgreSQL JDBC library -- Improper Authentication (2a220a73-4759-11f0-a44a-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-49146

medium

Tenable Plugins

medium

medium

medium

medium

high