Vulnerability in postgresql-9.1 - Bugfix Update
Summary
DLA-491-1: postgresql-9.1 - bugfix update. Affects postgresql-9.1 versions < 9.1.22-0+deb7u1. Fixed in 9.1.22-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards. It is widely used in various applications and industries. The vulnerability affects the PostgreSQL 9.1 branch, specifically related to OpenSSL calls and error queue handling. This vulnerability can lead to issues when multiple connections using OpenSSL are present within a single process, causing failures in client applications using SSL connections in libpq concurrently with SSL connections using PHP, Python, or Ruby wrappers for OpenSSL. Similar problems can also arise within the server if an extension module establishes an outgoing SSL connection.
Vulnerability Detail
The vulnerability arises due to the assumption that the OpenSSL error queue is clear before OpenSSL calls. This assumption can lead to problems when multiple connections using OpenSSL are present within a single process, and not all code involved follows the same rules for clearing the error queue. The reported failures occur when a client application uses SSL connections in libpq concurrently with SSL connections using the PHP, Python, or Ruby wrappers for OpenSSL. The issue can also affect the server if an extension module establishes an outgoing SSL connection. The impact of this vulnerability can result in unexpected behavior, connection failures, or security vulnerabilities.
How To Fix
Minimum fixed version
9.1.22-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by upgrading the postgresql-9.1 package to the latest version.
Conclusion
The vulnerability in postgresql-9.1 related to OpenSSL error queue handling can lead to unexpected behavior, connection failures, or security vulnerabilities. It is crucial to upgrade the postgresql-9.1 package to version 9.1.22-0+deb7u1 or later to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
The vulnerability can lead to unexpected behavior, connection failures, or security vulnerabilities when multiple connections using OpenSSL are present within a single process.
The vulnerability affects the PostgreSQL 9.1 branch.
No specific exploits have been reported for this vulnerability.
No specific workaround has been provided. It is recommended to upgrade the postgresql-9.1 package to the latest version.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
