com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...

com.datasqrl:sqrl-discovery (>=0.7.0, <=0.8.7), com.datasqrl:sqrl-planner (>=0.7.0, <=0.8.7) +20 more potentially affected by CVE-2025-59432 via com.ongres.scram:scram-common (>=3.0, <=3.1)

com.ongres.scram:scram-common MAVEN version =3.0, =0.7.0, =0.7.0, =0.7.0, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =1.0.0.rc1, =3.0, =2.4.0-rc1, =2.4.0-snashot and more Source cves: CVE-2025-59432 Source advisory: MEND:CVE-2025-59432...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the verifyClientProof function which use Arrays.equals function. An attacker can infer sensitive authentication material by exploiting timing differences during the comparison of secret values. Remediation Upgrade...

com.datasqrl:sqrl-discovery (>=0.7.0, <=0.8.7), com.datasqrl:sqrl-planner (>=0.7.0, <=0.8.7) +20 more potentially affected by CVE-2025-59432 via com.ongres.scram:scram-common (>=3.0, <=3.1)

com.ongres.scram:scram-common MAVEN version =3.0, =0.7.0, =0.7.0, =0.7.0, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =1.0.0.rc1, =3.0, =2.4.0-rc1, =2.4.0-snashot and more Source cves: CVE-2025-59432 Source advisory: GHSA-3WFH-36RX-9537...

com.datasqrl:sqrl-discovery (>=0.7.0, <=0.8.7), com.datasqrl:sqrl-planner (>=0.7.0, <=0.8.7) +20 more potentially affected by CVE-2025-59432 via com.ongres.scram:scram-common (>=3.0, <=3.1)

com.ongres.scram:scram-common MAVEN version =3.0, =0.7.0, =0.7.0, =0.7.0, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =1.0.0.rc1, =3.0, =2.4.0-rc1, =2.4.0-snashot and more Source cves: CVE-2025-59432 Source advisory: OSV:GHSA-3WFH-36RX-9537...

com.datasqrl:sqrl-discovery (>=0.7.0, <=0.8.7), com.datasqrl:sqrl-planner (>=0.7.0, <=0.8.7) +20 more potentially affected by CVE-2025-59432 via com.ongres.scram:scram-common (>=3.0, <=3.1)

com.ongres.scram:scram-common MAVEN version =3.0, =0.7.0, =0.7.0, =0.7.0, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =0.3.124, =1.0.0.rc1, =3.0, =2.4.0-rc1, =2.4.0-snashot and more Source cves: CVE-2025-59432 Source advisory: SNYK:JAVA-COMONGRESSCRAM-12818392...