Vulnerability in postgresql-9.1
Summary
DSA-2865-1: postgresql-9.1 - several. Affects postgresql-9.1 versions < 9.1.12-0wheezy1. Fixed in 9.1.12-0wheezy1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness and extensive features. It is widely used in various applications and environments. The vulnerability affects the postgresql-9.1 package in the Debian 7 ecosystem.
Vulnerability Detail
The postgresql-9.1 package is impacted by multiple vulnerabilities:
-
CVE-2014-0060: This vulnerability allows a role member to bypass restrictions and revoke the access of others, contrary to the grantor's wishes.
-
CVE-2014-0061: Privilege escalation can occur through manual calls to PL validator functions, which can be exploited for unauthorized access.
-
CVE-2014-0062: Concurrent activity during table and index DDL operations can lead to privilege escalation attacks.
-
CVE-2014-0063: Buffer overrun can occur with long datetime strings, potentially leading to denial of service or arbitrary code execution.
-
CVE-2014-0064: Integer overflow in size calculations can result in buffer overrun, leading to potential code execution.
-
CVE-2014-0065: Fixed-size buffers can be overrun, potentially leading to memory corruption or code execution.
-
CVE-2014-0066: A crash can occur if crypt() returns NULL, which can be triggered in certain scenarios.
-
CVE-2014-0067: The make check command can expose the temporary server to trust authentication, allowing potential privilege escalation by untrusted users.
These vulnerabilities pose various risks, including unauthorized access, privilege escalation, denial of service, and potential code execution.
How To Fix
Minimum fixed version
9.1.12-0wheezy1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been mentioned for these vulnerabilities.
Conclusion
The postgresql-9.1 package is affected by multiple vulnerabilities that can result in unauthorized access, privilege escalation, denial of service, and potential code execution. It is crucial to upgrade to the recommended versions mentioned above to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
CVE-2014-0060 allows a role member to revoke the access of others, contrary to the grantor's wishes. This can lead to unauthorized access and potential misuse of privileges.
CVE-2014-0061 can be exploited by making manual calls to PL validator functions, allowing privilege escalation and unauthorized access to sensitive data or functionality.
CVE-2014-0062 poses a risk of privilege escalation during table and index DDL operations. If name lookups come to different conclusions due to concurrent activity, permissions checks can be performed against a different table than intended, allowing unauthorized access.
CVE-2014-0063 can result in buffer overrun with long datetime strings, potentially leading to denial of service or arbitrary code execution. It may also cause rejection of valid inputs containing very long timezone names.
CVE-2014-0064 can be exploited by triggering an integer overflow in size calculations, leading to buffer overrun and potential code execution. This vulnerability affects several functions, mostly type input functions.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
