Vulnerability Description
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | < 9.0.20 |
| Debian | Debian Linux | 7.0 |
| Canonical | Ubuntu Linux | 12.04 |
Related Weaknesses (CWE)
References
- http://ubuntu.com/usn/usn-2621-1Third Party Advisory
- http://www.debian.org/security/2015/dsa-3269Third Party Advisory
- http://www.debian.org/security/2015/dsa-3270Third Party Advisory
- http://www.postgresql.org/about/news/1587/Vendor Advisory
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/9.2/static/release-9-2-11.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/9.3/static/release-9-3-7.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/9.4/static/release-9-4-2.htmlRelease NotesVendor Advisory
- http://ubuntu.com/usn/usn-2621-1Third Party Advisory
- http://www.debian.org/security/2015/dsa-3269Third Party Advisory
- http://www.debian.org/security/2015/dsa-3270Third Party Advisory
- http://www.postgresql.org/about/news/1587/Vendor Advisory
- http://www.postgresql.org/docs/9.0/static/release-9-0-20.htmlRelease NotesVendor Advisory
- http://www.postgresql.org/docs/9.1/static/release-9-1-16.htmlRelease NotesVendor Advisory
FAQ
What is CVE-2015-3167?
CVE-2015-3167 is a vulnerability with a CVSS score of 7.5 (HIGH). contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which m...
How severe is CVE-2015-3167?
CVE-2015-3167 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-3167?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql, Debian Debian Linux, Canonical Ubuntu Linux.