Vulnerability Description
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | < 9.0.19 |
| Debian | Debian Linux | 7.0 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2015/dsa-3155Third Party Advisory
- http://www.postgresql.org/about/news/1569/Vendor Advisory
- http://www.postgresql.org/docs/9.4/static/release-9-4-1.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-0-19.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-1-15.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-2-10.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-3-6.htmlRelease NotesVendor Advisory
- http://www.debian.org/security/2015/dsa-3155Third Party Advisory
- http://www.postgresql.org/about/news/1569/Vendor Advisory
- http://www.postgresql.org/docs/9.4/static/release-9-4-1.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-0-19.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-1-15.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-2-10.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/current/static/release-9-3-6.htmlRelease NotesVendor Advisory
FAQ
What is CVE-2014-8161?
CVE-2014-8161 is a vulnerability with a CVSS score of 4.3 (MEDIUM). PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constra...
How severe is CVE-2014-8161?
CVE-2014-8161 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-8161?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql, Debian Debian Linux.