russell@unturf.com 6b80a87270 snort3: CWE-407 CHP match_tally O(M*T); pgbouncer: CWE-312 SCRAM secret logged

snort3-0002: chp_add_candidate_to_tally() in http_url_patterns.cc calls std::find_if
over CHPMatchTally vector for each Aho-Corasick HTTP key-pattern match callback,
O(M*T) per packet. Fix: add unordered_map index to ChpMatchDescriptor for O(1) lookup.
48x op-count reduction at T=100/M=20. 3/3 PASS.

pgbouncer-0001: scram_client_first() logs user->passwd (SCRAM verifier or plaintext
password) at slog_debug level, CWE-312. Fix: remove the log line. 5/5 PASS.

pgbouncer MOAD-0002/0003/0005 CLEAN (single-threaded libevent loop).
snort3 MOAD-0002/0003/0004/0005 CLEAN.

2026-03-31 20:06:15 -04:00

1.4 KiB

Raw Blame History

PgBouncer — CLEAN (CWE-407) | DEFECT pgbouncer-0001 (CWE-312)

Scanned 2026-03-30 (CWE-407 only). Re-scanned 2026-03-31 (all 5 MOADs).

MOAD-0001 (CWE-407) — CLEAN

PgBouncer uses efficient data structures throughout:

User lookup: AA-tree (aatree_search) — O(log N)
Prepared statements: uthash — O(1)
Session variable cache: uthash — O(1)
HBA name sets: cbtree (crit-bit tree) for >10 entries — O(log N)
Database lookup: find_database() is linear scan of database_list, but databases are configuration-bounded (typically <100), not attacker-controlled.

MOAD-0002 (Intertangle) — CLEAN

PgBouncer is single-threaded (libevent loop). Global lists (database_list, pool_list, user_tree) are accessed from one thread only. No shared mutable god object coupling independent subsystems.

MOAD-0003 (Leaked Context) — CLEAN

Single-threaded event loop. No thread_local or pthread_key carrying request-scoped identity. Not applicable.

MOAD-0004 (CWE-312) — DEFECT: see pgbouncer-0001

src/client.c function scram_client_first() line 1124:

slog_debug(client, "stored secret = \"%s\"", user->passwd);

Logs user->passwd at debug level. Depending on auth_type, this is a SCRAM-SHA-256 verifier (offline-crackable) or a plaintext password. Fix: remove log line.

MOAD-0005 (Thundering Herd) — CLEAN

Single-threaded. No concurrent cache access patterns. Not applicable.

1.4 KiB Raw Blame History