-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 20 Dec 2025 13:52:56 +0100
Source: pgbouncer
Binary: pgbouncer pgbouncer-dbgsym
Architecture: riscv64
Version: 1.24.1-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: riscv64 Build Daemon (rv-osuosl-04) <buildd_riscv64-rv-osuosl-04@buildd.debian.org>
Changed-By: Andreas Henriksson <andreas@fatal.se>
Description:
 pgbouncer  - lightweight connection pooler for PostgreSQL
Changes:
 pgbouncer (1.24.1-1+deb13u1) trixie; urgency=medium
 .
   * Non-maintainer upload by the Debian LTS Security Team.
   * CVE-2025-12819: execute arbitrary SQL during authentication.
     Untrusted search path in auth_query connection handler in PgBouncer
     before 1.25.1 allows an unauthenticated attacker to execute arbitrary
     SQL during authentication via a malicious search_path parameter in the
     StartupMessage.
Checksums-Sha1:
 468844e766b098cabe7ce9cdc8aec1adb9d5140b 542524 pgbouncer-dbgsym_1.24.1-1+deb13u1_riscv64.deb
 03dcf96aac88c77ef1258eb41beb617ee34087b9 8629 pgbouncer_1.24.1-1+deb13u1_riscv64-buildd.buildinfo
 d8e134dab42320433cb47126dbe809f3f2d64e4b 258440 pgbouncer_1.24.1-1+deb13u1_riscv64.deb
Checksums-Sha256:
 3af3141ecb2845331f195b545b7a1b963205ff30648de912e9167ce1f5ec62c5 542524 pgbouncer-dbgsym_1.24.1-1+deb13u1_riscv64.deb
 ca1e2ee1a082456c735201d992ec93575e4200dff5544d5b28b23e65649ebf2b 8629 pgbouncer_1.24.1-1+deb13u1_riscv64-buildd.buildinfo
 7c347d836bbbd48084c5103461656e58058a2f637b86c6ef0ee8b2693e71a7af 258440 pgbouncer_1.24.1-1+deb13u1_riscv64.deb
Files:
 5a6f33cbd8e7508634c1c1a79a9b52cb 542524 debug optional pgbouncer-dbgsym_1.24.1-1+deb13u1_riscv64.deb
 ad5b016ccf57615cef0a48ef286b2542 8629 database optional pgbouncer_1.24.1-1+deb13u1_riscv64-buildd.buildinfo
 497b720a2683dea8c77cf01887cc4821 258440 database optional pgbouncer_1.24.1-1+deb13u1_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgLDDByWcR07HDSHyNVgvumj7+mMFAmlXBt8ACgkQNVgvumj7
+mNLjBAAnkyoRaVY9ET8pD9GXkKkPVNaM4K/KdVA6q3wrWAaDsI4NqhFqDHJRWlp
zaKxvqSJjM/t8rCSKMl5+rfx7SEul1ovTD6O9vvEyM3p7XLNoIkYsfapNNCxIiz0
gQniOvpxU0eohs2Eru5SBpSBYxBY7GecLRTZwmvK7mZEGQOlbyaLScvy1GqOW6h3
sT50kg5r5tTMx14jtFopu4g6J1PrXVptM05VL1XfjWZdQL8wj5JOf0YkxncZzkNc
asQ8M9UAHHZdX9VsStbj/r/a8693LkfdOuAb6LY72knWc9FByCFAi9jPvT2zTSd/
U6AvQ6wyvQf2I9M3K6ByS3kpeC2Gk7vdmdPfqRGftluN5bH0gipkCPn1FXeCKEBB
EUjIYqYY87KQ0JpBJsx+DnhAEaasbWrDaPCfzJ2WL6/eZFWEldlZA7imbk8zoFzf
2M7tXzlFONJvez8q1wrq+8It22e/meiqHfA/z1yqK+h3tz8z9fsVo+cTjViwrWmU
e9SdeIzQl8Urta7mi/gUqqPoxc3KOL6OlhKFyY7D31tdeBCh20puoaXvlTacyAz/
zjvd43XAOQuysyFqmMRjJiur/6AomiKPvvyiFx6YMxkI9LpWN8qe1LKzPt+llz5a
wsldYKh95OxCm3l1RyOk7Ku19B9oJYjpqb5yS4QntcixCVbKeXk=
=I1Gw
-----END PGP SIGNATURE-----