russell@unturf.com 6b80a87270 snort3: CWE-407 CHP match_tally O(M*T); pgbouncer: CWE-312 SCRAM secret logged

snort3-0002: chp_add_candidate_to_tally() in http_url_patterns.cc calls std::find_if
over CHPMatchTally vector for each Aho-Corasick HTTP key-pattern match callback,
O(M*T) per packet. Fix: add unordered_map index to ChpMatchDescriptor for O(1) lookup.
48x op-count reduction at T=100/M=20. 3/3 PASS.

pgbouncer-0001: scram_client_first() logs user->passwd (SCRAM verifier or plaintext
password) at slog_debug level, CWE-312. Fix: remove the log line. 5/5 PASS.

pgbouncer MOAD-0002/0003/0005 CLEAN (single-threaded libevent loop).
snort3 MOAD-0002/0003/0004/0005 CLEAN.

2026-03-31 20:06:15 -04:00

1.8 KiB

Raw Blame History

pgbouncer-0001: CWE-312 — SCRAM verifier logged verbatim at debug level

Target

PgBouncer PostgreSQL connection pooler: src/client.c, function scram_client_first()

Defect

Line 1124:

slog_debug(client, "stored secret = \"%s\"", user->passwd);

During SCRAM-SHA-256 authentication, PgBouncer logs user->passwd at debug level. The stored secret is either:

A SCRAM-SHA-256 verifier string: SCRAM-SHA-256$<iters>:<salt>$<StoredKey>:<ServerKey>
A plaintext password (when auth_type=plain is configured)

Either form is sensitive. A SCRAM verifier can be used in an offline dictionary attack to recover the original password. A plaintext password is immediately usable.

Debug logging is commonly enabled during troubleshooting and the output is written to persistent log files, creating indefinite credential exposure.

Fix

Remove the slog_debug line. The adjacent line 1119 already logs the SCRAM event (SCRAM client-first-message), preserving diagnostic context without exposing the secret.

Severity

MEDIUM-HIGH (CWE-312). Requires debug log access, but operators routinely enable debug logging during connection issues, leaving credentials in log files indefinitely.

All 5 MOAD Results for PgBouncer

MOAD	Status	Notes
0001 (CWE-407)	CLEAN	find_database() is O(D) but D is config-bounded (<100 DBs typical); user lookup uses AA-tree O(log U)
0002 (Intertangle)	CLEAN	Single-threaded libevent loop; no coupling via shared mutable runtime state
0003 (Leaked Context)	CLEAN	Single-threaded; no thread_local usage; not applicable
0004 (CWE-312)	DEFECT	pgbouncer-0001: client.c:1124 logs SCRAM verifier/password at slog_debug
0005 (Thundering Herd)	CLEAN	Single-threaded; no concurrent cache access; not applicable

1.8 KiB Raw Blame History