Security Update for PostgreSQL-9.1
Summary
DSA-3269-1: postgresql-9.1 - security update. Affects postgresql-9.1 versions < 9.1.16-0+deb7u1. Fixed in 9.1.16-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL-9.1 is a SQL database system that provides a robust and feature-rich environment for managing relational databases. It is widely used in various applications and industries. However, several vulnerabilities have been discovered in PostgreSQL-9.1, which could potentially compromise the security and stability of the system.
Vulnerability Detail
The vulnerabilities found in PostgreSQL-9.1 include:
-
Remote crash (CVE-2015-3165): If SSL clients disconnect just before the authentication timeout expires, it can cause the server to crash.
-
Information exposure (CVE-2015-3166): The replacement implementation of snprintf() fails to check for errors reported by the underlying system library calls, potentially leading to information exposure in out-of-memory situations.
-
Possible side-channel key exposure (CVE-2015-3167): In some cases of decryption with an incorrect key in contrib/pgcrypto, error message texts could be reported, potentially exposing sensitive information. This vulnerability is fixed by using a one-size-fits-all message.
How To Fix
Minimum fixed version
9.1.16-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
PostgreSQL-9.1 is affected by multiple vulnerabilities that can lead to server crashes, information exposure, and side-channel key exposure. It is crucial to upgrade to the fixed versions mentioned in the 'how_to_fix' section to ensure the security and stability of your PostgreSQL-9.1 installation. For additional support, please reach out to DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
These vulnerabilities can potentially lead to server crashes, information exposure, and side-channel key exposure, compromising the security and stability of the PostgreSQL-9.1 database system.
You can use Vulert's playground at Vulert Scanner to check if your PostgreSQL-9.1 installation is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to upgrade to the fixed versions of PostgreSQL-9.1 as mentioned in the 'how_to_fix' section.
Yes, the remote crash vulnerability (CVE-2015-3165) can be exploited remotely by SSL clients disconnecting just before the authentication timeout expires.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
