CVE-2015-3167

高危 7.5CVE-2015-3167 · Published 20/11/2019 · updated 17/06/2026

要点

CVE-2015-3167 是影响 postgresql (postgresql) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：4.1%，高于 90.8% 的漏洞。
修复：升级到 9.1.16, 9.2.11, 9.3.7, 9.4.2 或更高版本。

Package	Affected versions	Patched versions
postgresql postgresql	`≥ 9.1, < 9.1.16≥ 9.2, < 9.2.11≥ 9.3, < 9.3.7≥ 9.4, < 9.4.2< 9.0.20`	`9.1.169.2.119.3.79.4.29.0.20`

Description

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

References

ubuntu.com/usn/usn-2621-1 · Third Party Advisory
debian.org/security/2015/dsa-3269 · Third Party Advisory
debian.org/security/2015/dsa-3270 · Third Party Advisory
postgresql.org/about/news/1587 · Vendor Advisory
postgresql.org/docs/9.0/static/release-9-0-20.html · Release Notes
postgresql.org/docs/9.1/static/release-9-1-16.html · Release Notes
postgresql.org/docs/9.2/static/release-9-2-11.html · Release Notes
postgresql.org/docs/9.3/static/release-9-3-7.html · Release Notes
postgresql.org/docs/9.4/static/release-9-4-2.html · Release Notes

postgresql 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

postgresql

≥ 9.1, < 9.1.16≥ 9.2, < 9.2.11≥ 9.3, < 9.3.7≥ 9.4, < 9.4.2< 9.0.20

9.1.169.2.119.3.79.4.29.0.20

postgresql 的其他漏洞

查看全部 →