From ec7c3b180c0be061a63eafe6d59366a3c5215114 Mon Sep 17 00:00:00 2001 From: Tatsuo Ishii Date: Sat, 17 May 2025 15:24:23 +0900 Subject: [PATCH] Suppress unnecessary information upon authentication failure. Previously a message "password size does not match" was displayed when client authentication failed. This could help an attacker to guess password. Replace it just "password does not match". Backpatch-through: v4.2 --- src/auth/pool_auth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/auth/pool_auth.c b/src/auth/pool_auth.c index b6bec79e2..6d78b8528 100644 --- a/src/auth/pool_auth.c +++ b/src/auth/pool_auth.c @@ -1042,7 +1042,7 @@ do_clear_text_password(POOL_CONNECTION * backend, POOL_CONNECTION * frontend, in if (size != backend->pwd_size) ereport(ERROR, (errmsg("clear text password authentication failed"), - errdetail("password size does not match"))); + errdetail("password does not match"))); if (memcmp(pwd, backend->password, backend->pwd_size) != 0) ereport(ERROR, -- 2.39.5