Information disclosure in PostgreSQL - CVE-2015-3167

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU30590

Information disclosure in PostgreSQL - CVE-2015-3167

Published: November 20, 2019 / Updated: July 17, 2020


Vulnerability identifier: #VU30590
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-3167
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.


Affected software

PostgreSQL
Amazon Linux AMI
Gentoo Linux
Ubuntu
postgresql (Alpine package)
postgresql-9.1 (Ubuntu package)
postgresql-9.3 (Ubuntu package)
postgresql-9.4 (Ubuntu package)

How to mitigate CVE-2015-3167

Install update from vendor's website.

PostgreSQL - update to 9.4.2
postgresql (Alpine package) - update to 9.3.7-r0
postgresql-9.1 (Ubuntu package) - update to 9.1.16-0ubuntu0.12.04
postgresql-9.3 (Ubuntu package) - update to 9.3.7-0ubuntu0.14.04
postgresql-9.4 (Ubuntu package) - addressed in versions 9.4.2-0ubuntu0.14.10, 9.4.2-0ubuntu0.15.04

External References

Related Security Bulletins