CVEvulnerability
CVE-2015-3167
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-11-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
Affected configurations
• postgresql postgresql (< 9.0.20)
• postgresql postgresql (>= 9.1 < 9.1.16)
• postgresql postgresql (>= 9.2 < 9.2.11)
• postgresql postgresql (>= 9.3 < 9.3.7)
• postgresql postgresql (>= 9.4 < 9.4.2)
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 14.10
• canonical ubuntu linux 15.04
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://ubuntu.com/usn/usn-2621-1 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3269 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3270 Third Party Advisory
- http://www.postgresql.org/about/news/1587/ Vendor Advisory
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.html Release Notes, Vendor Advisory
- http://ubuntu.com/usn/usn-2621-1 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3269 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3270 Third Party Advisory
- http://www.postgresql.org/about/news/1587/ Vendor Advisory
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.html Release Notes, Vendor Advisory
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.html Release Notes, Vendor Advisory