engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

snort3: CWE-407 CHP match_tally O(M*T); pgbouncer: CWE-312 SCRAM secret logged

Browse source 
snort3-0002: chp_add_candidate_to_tally() in http_url_patterns.cc calls std::find_if
over CHPMatchTally vector for each Aho-Corasick HTTP key-pattern match callback,
O(M*T) per packet. Fix: add unordered_map index to ChpMatchDescriptor for O(1) lookup.
48x op-count reduction at T=100/M=20. 3/3 PASS.

pgbouncer-0001: scram_client_first() logs user->passwd (SCRAM verifier or plaintext
password) at slog_debug level, CWE-312. Fix: remove the log line. 5/5 PASS.

pgbouncer MOAD-0002/0003/0005 CLEAN (single-threaded libevent loop).
snort3 MOAD-0002/0003/0004/0005 CLEAN.
This commit is contained in:
russell@unturf.com 2026-03-31 20:06:15 -04:00
parent 62305ef339
commit 6b80a87270
12 changed files with 525 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
defects/pgbouncer-0001/patch/pgbouncer-0001.patch Normal file
View file

@ -0,0 +1,10 @@
--- a/src/client.c
+++ b/src/client.c
@@ -1121,7 +1121,7 @@ static bool scram_client_first(PgSocket *client, uint32_t datalen, const uint8_t
if (!user->mock_auth) {
- slog_debug(client, "stored secret = \"%s\"", user->passwd);
+ /* Do not log user->passwd: it holds the SCRAM verifier or plaintext password (CWE-312). */
switch (get_password_type(user->passwd)) {
case PASSWORD_TYPE_MD5:
slog_error(client, "SCRAM authentication failed: user has MD5 secret");