PT-2015-2594 · Postgresql+4 · Postgresql+4

Josh Kupershmidt · Published 2015-10-08 · Updated 2024-06-15 · CVE-2015-5288

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 9.0.23 PostgreSQL versions 9.1.x prior to 9.1.19 PostgreSQL versions 9.2.x prior to 9.2.14 PostgreSQL versions 9.3.x prior to 9.3.10 PostgreSQL versions 9.4.x prior to 9.4.5

Description The issue is related to the crypt function in the contrib/pgcrypto component of the PostgreSQL database management system, which lacks protection of service data. This can be exploited by a remote attacker to cause a denial of service, such as a server crash, or to read arbitrary server memory via a "too-short" salt. A memory leak in the crypt() function is also mentioned.

Recommendations For versions prior to 9.0.23, update to version 9.0.23 or later. For versions 9.1.x prior to 9.1.19, update to version 9.1.19 or later. For versions 9.2.x prior to 9.2.14, update to version 9.2.14 or later. For versions 9.3.x prior to 9.3.10, update to version 9.3.10 or later. For versions 9.4.x prior to 9.4.5, update to version 9.4.5 or later.

Fix

DoS

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-11959

CESA-2015_2078

CESA-2015_2081

CVE-2015-5288

DLA-329-1

DSA-3374-1

DSA-3475-1

MGASA-2015-0420

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

RHSA-2015:2077

RHSA-2015:2078

RHSA-2015:2081

RHSA-2015:2083

RHSA-2015_2078

RHSA-2015_2081

SUSE-OU-2015:1847-1

SUSE-SU-2015:1821-1

SUSE-SU-2015_1821-1

SUSE-SU-2016:0389-1

SUSE-SU-2016:0482-1

SUSE-SU-2016:0677-1

SUSE-SU-2016_0389-1

SUSE-SU-2016_0482-1

USN-2772-1

Affected Products

Centos

Postgresql

Red Hat

Suse

Ubuntu

References · 136

• http://postgresql.org/docs/9.1/static/release-9-1-19.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2081.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0766 · Security Note
• http://postgresql.org/docs/9.4/static/release-9-4-5.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5288 · Security Note
• https://bdu.fstec.ru/vul/2015-11958 · Security Note
• https://osv.dev/vulnerability/USN-2772-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10030-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-OU-2015:1847-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3374-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3475 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172316.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5288 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0677-1 · Vendor Advisory