CVE-2015-3167

ALTO 7.5CVE-2015-3167 · Published 20/11/2019 · updated 17/06/2026

In breve

CVE-2015-3167 è una vulnerabilità ALTO (CVSS 7.5) che riguarda postgresql (postgresql).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.1%, superiore al 90.8% delle vulnerabilità.
Correzione: aggiornare a 9.1.16, 9.2.11, 9.3.7, 9.4.2 o successiva.

Package	Affected versions	Patched versions
postgresql postgresql	`≥ 9.1, < 9.1.16≥ 9.2, < 9.2.11≥ 9.3, < 9.3.7≥ 9.4, < 9.4.2< 9.0.20`	`9.1.169.2.119.3.79.4.29.0.20`

Description

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

References

ubuntu.com/usn/usn-2621-1 · Third Party Advisory
debian.org/security/2015/dsa-3269 · Third Party Advisory
debian.org/security/2015/dsa-3270 · Third Party Advisory
postgresql.org/about/news/1587 · Vendor Advisory
postgresql.org/docs/9.0/static/release-9-0-20.html · Release Notes
postgresql.org/docs/9.1/static/release-9-1-16.html · Release Notes
postgresql.org/docs/9.2/static/release-9-2-11.html · Release Notes
postgresql.org/docs/9.3/static/release-9-3-7.html · Release Notes
postgresql.org/docs/9.4/static/release-9-4-2.html · Release Notes

Altre vulnerabilità di postgresql

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

postgresql

≥ 9.1, < 9.1.16≥ 9.2, < 9.2.11≥ 9.3, < 9.3.7≥ 9.4, < 9.4.2< 9.0.20

9.1.169.2.119.3.79.4.29.0.20

Altre vulnerabilità di postgresql

Vedi tutto →