Vulnerability in postgresql-9.1: Multiple Security Issues
Summary
DSA-2658-1: postgresql-9.1 - several. Affects postgresql-9.1 versions < 9.1.9-0wheezy1. Fixed in 9.1.9-0wheezy1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards. It is widely used in various applications and industries. The vulnerability affects the postgresql-9.1 package in the Debian 7 ecosystem.
Vulnerability Detail
Multiple security issues have been discovered in the postgresql-9.1 package:
-
CVE-2013-1899: A crafted connection request with a database name starting with '-' can cause damage or destruction of files within the server's data directory. This vulnerability can be exploited by anyone with access to the PostgreSQL server's listening port.
-
CVE-2013-1900: Random numbers generated by certain functions in the contrib/pgcrypto module may be easy to guess for another database user.
-
CVE-2013-1901: An unprivileged user can execute commands that interfere with ongoing backups.
How To Fix
Minimum fixed version
9.1.9-0wheezy1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Multiple security vulnerabilities have been identified in the postgresql-9.1 package. To ensure the security and stability of your system, it is crucial to upgrade to version 9.1.9-0wheezy1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
CVE-2013-1899 allows an attacker to craft a connection request that can damage or destroy files within the PostgreSQL server's data directory. This can lead to data loss, system instability, and potential unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, an unprivileged user can execute commands that interfere with ongoing backups, potentially disrupting the backup process and affecting data integrity.
To mitigate the risk of guessing random numbers generated by contrib/pgcrypto functions, it is recommended to limit access to trusted database users and implement strong access controls.
Upgrading the package to the fixed version is the recommended solution. However, if upgrading is not feasible, you can consider implementing additional security measures, such as network segmentation and access restrictions, to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
