{"record":{"id":"8078e3ccbd80ded5","repo":"sqlmapproject/sqlmap","slug":"malformed-scram-server-signature-s","errorCode":null,"errorMessage":"malformed SCRAM server signature (%s)","messagePattern":"malformed SCRAM server signature \\((.+?)\\)","errorType":"exception","errorClass":"OperationalError","httpStatus":null,"severity":"error","filePath":"extra/dbwire/postgres.py","lineNumber":290,"sourceCode":"            client_sig = hmac.new(stored_key, auth_message.encode(\"ascii\"), hashlib.sha256).digest()\n            proof = base64.b64encode(_xor(client_key, client_sig)).decode(\"ascii\")\n            _send(sock, b\"p\", (\"%s,p=%s\" % (client_final_noproof, proof)).encode(\"ascii\"))\n        elif code == 12:  # SASLFinal (server-final): verify the server too, or the handshake is one-way\n            # Without this the client proves itself to the server and simply trusts whatever answers back.\n            # ServerSignature = HMAC(ServerKey, AuthMessage) can only be produced by a peer that holds the\n            # stored credentials, so comparing it is what makes the exchange mutual (RFC 5802 5, 5.1).\n            if salted is None or auth_message is None:\n                raise OperationalError(\"unexpected SCRAM server-final message\")\n            try:\n                attrs = dict(kv.split(\"=\", 1) for kv in payload[4:].decode(\"ascii\").split(\",\"))\n            except (ValueError, UnicodeDecodeError) as ex:\n                raise OperationalError(\"malformed SCRAM server-final message (%s)\" % ex)\n            if \"e\" in attrs:\n                raise OperationalError(\"SCRAM authentication failed (%s)\" % attrs[\"e\"])\n            try:\n                signature = base64.b64decode(attrs[\"v\"])\n            except (KeyError, binascii.Error, ValueError) as ex:\n                raise OperationalError(\"malformed SCRAM server signature (%s)\" % ex)\n            server_key = hmac.new(salted, b\"Server Key\", hashlib.sha256).digest()\n            expected = hmac.new(server_key, auth_message.encode(\"ascii\"), hashlib.sha256).digest()\n            if not hmac.compare_digest(signature, expected):\n                raise OperationalError(\"SCRAM server signature mismatch (rogue server?)\")\n        else:\n            raise InterfaceError(\"unsupported authentication request %d\" % code)\n\ndef _raise_server_error_as_operational(payload):\n    message, _ = _error_message(payload)\n    raise OperationalError(\"(remote) %s\" % message)\n\ndef connect(host=None, port=5432, user=None, password=None, database=None, connect_timeout=None, **kwargs):\n    try:\n        sock = socket.create_connection((host or \"localhost\", int(port or 5432)), timeout=connect_timeout)\n        keepalive(sock)\n    except (socket.error, socket.timeout) as ex:\n        raise OperationalError(\"could not connect to '%s:%s' (%s)\" % (host, port, ex))\n","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/extra/dbwire/postgres.py#L272-L308","documentation":"Error \"malformed SCRAM server signature (%s)\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at extra/dbwire/postgres.py:290 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}