pgpool2 (4.7.3-1) [PTS] [DDPO]

OK: VCS matches the version in the archive

Git: https://salsa.debian.org/postgresql/pgpool2.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 3272704
Browser: https://salsa.debian.org/postgresql/pgpool2
Last scan: 2026-10-10 11:10:12+00
Next scan: 2026-10-15 17:21:00+00
CI pipeline status: success

Debian changelog in Git:

pgpool2 (4.7.3-1) unstable; urgency=medium

  * New upstream version 4.7.3. (Closes: #1149670)
  * CVE-2026-92867:
    An out-of-bounds write vulnerability exists in Pgpool-II , which may
    allow an authenticated attacker to cause abnormal process
    termination or arbitrary code execution.
  * CVE-2026-92868:
    An improper certificate validation vulnerability exists in Pgpool-
    II, which may allow an unauthenticated attacker to bypass client
    certificate authentication.
  * CVE-2026-92869:
    An out-of-bounds write vulnerability exists in Pgpool-II, which may
    allow an authenticated attacker to cause abnormal process
    termination.
  * CVE-2026-92870:
    A stack-based buffer overflow vulnerability exists in Pgpool-II,
    which may allow an unauthenticated attacker to cause abnormal
    process termination.
  * CVE-2026-92871:
    A NULL pointer dereference vulnerability exists in Pgpool-II, which
    may allow an unauthenticated attacker to cause abnormal termination
    of the watchdog process.
  * CVE-2026-92872:
    Pgpool-II inserts sensitive information into log file, which may
    allow an authenticated attacker to obtain the cluster information.
  * CVE-2026-92873:
    Pgpool-II contains an incorrect implementation of an authentication
    algorithm, which may allow an unauthenticated attacker to promote an
    arbitrary watchdog node to the leader node.

 -- Christoph Berg <myon@debian.org>  Fri, 02 Oct 2026 10:06:02 +0200

This branch is even with tag debian/4.7.3-1