PT-2017-7049 · Pgbouncer · Pgbouncer

Published 2017-05-23 · Updated 2020-11-03 · CVE-2015-6817

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PgBouncer versions 1.6.x before 1.6.1

Description The issue allows remote attackers to gain login access as auth user via an unknown username when PgBouncer is configured with auth user.

Recommendations For PgBouncer versions 1.6.x before 1.6.1, update to version 1.6.1 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2015-6817

Affected Products

Pgbouncer

References · 10

• https://github.com/pgbouncer/pgbouncer/commit/7ca3e5279d05fceb1e8a043c6f5b6f58dea3ed38 · Patch
• https://github.com/pgbouncer/pgbouncer/issues/69 · Patch
• https://osv.dev/vulnerability/CVE-2015-6817 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/09/05/7 · Patch
• https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-24 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-6817 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-6817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6817 · Security Note
• http://comments.gmane.org/gmane.comp.db.postgresql.pgbouncer.general/1251 · Note