DSA-3269-2: PostgreSQL-9.1 - Regression Update
Summary
DSA-3269-2: postgresql-9.1 - regression update. Affects postgresql-9.1 versions < 9.1.16-0+deb7u2. Fixed in 9.1.16-0+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL-9.1 is a SQL database system that provides a robust and feature-rich platform for managing relational databases. It is widely used in various applications and environments. However, several vulnerabilities have been discovered in PostgreSQL-9.1, which require immediate attention and remediation.
Vulnerability Detail
The vulnerabilities in PostgreSQL-9.1 include:
-
CVE-2015-3165: Remote Crash
- SSL clients disconnecting just before the authentication timeout expires can cause the server to crash.
-
CVE-2015-3166: Information Exposure
- The replacement implementation of snprintf() fails to check for errors reported by the underlying system library calls, potentially leading to information exposure in out-of-memory situations.
-
CVE-2015-3167: Possible Side-Channel Key Exposure
- In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts, potentially exposing sensitive information.
These vulnerabilities pose risks such as server crashes, information exposure, and possible side-channel key exposure, which could be exploited by malicious actors to disrupt services, gain unauthorized access, or extract sensitive data.
How To Fix
Minimum fixed version
9.1.16-0+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is essential to apply the recommended fixes by upgrading the PostgreSQL-9.1 packages to the latest versions.
Conclusion
PostgreSQL-9.1 is affected by multiple vulnerabilities that can lead to server crashes, information exposure, and possible side-channel key exposure. It is crucial to upgrade the PostgreSQL-9.1 packages to the recommended versions to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
These vulnerabilities can lead to server crashes, information exposure, and possible side-channel key exposure, posing risks such as service disruption, unauthorized access, and data compromise.
To fix these vulnerabilities, upgrade the PostgreSQL-9.1 packages to the recommended versions mentioned in the 'how_to_fix' section.
No specific workarounds are mentioned for these vulnerabilities. It is crucial to apply the recommended fixes by upgrading the PostgreSQL-9.1 packages.
The oldstable distribution (wheezy) and the stable distribution (jessie) are affected. The testing distribution (stretch) and the unstable distribution (sid) do not contain the postgresql-9.1 package.
For more information, refer to the provided CVE links in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
