GO-2026-6166
GSS authentication completes without mutual proof in github.com/lib/pq
Details
github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS token and stores the provider, but it tracks neither whether a continuation occurred nor the provider's done result. The startup loop then accepts AuthenticationOk and completes the connection. The continuation branch also discards provider errors and can proceed after failed mutual authentication.
Are you affected?
Enter the version of the package you're using.
Affected packages
1.6.0 No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.