Security Update for postgresql-9.1
Summary
DSA-3475-1: postgresql-9.1 - security update. Affects postgresql-9.1 versions < 9.1.20-0+deb7u1. Fixed in 9.1.20-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL-9.1 is a SQL database system that provides a robust and reliable platform for managing data. It offers various features and functionalities for storing, querying, and manipulating structured data. However, several vulnerabilities have been discovered in PostgreSQL-9.1, which require immediate attention to ensure the security and integrity of the database system.
Vulnerability Detail
The vulnerabilities in PostgreSQL-9.1 include:
-
CVE-2015-5288: A vulnerability in the crypt() function of the pgCrypto extension can cause the server to crash or disclose a few bytes of server memory when certain invalid salt arguments are used.
-
CVE-2016-0766: Users of PL/Java are susceptible to a privilege escalation vulnerability. Certain custom configuration settings (GUCs) for PL/Java can be modified by non-superusers, leading to potential security breaches. To mitigate this issue, these settings will now be modifiable only by the database superuser.
-
CVE-2016-0773: A flaw in the way PostgreSQL processes specially crafted regular expressions can result in infinite loops or memory overwrites. This can be exploited by a remote attacker to cause a denial of service or potentially execute arbitrary code.
How To Fix
Minimum fixed version
9.1.20-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to address the identified vulnerabilities in postgresql-9.1 to ensure the security and stability of your database system. Upgrading to version 9.1.20-0+deb7u1 or later is recommended. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-9.1 →
FAQ
CVE-2015-5288 can lead to server crashes or the disclosure of a few bytes of server memory. While the impact may vary depending on the specific circumstances, it is crucial to address this vulnerability to prevent potential security breaches.
Users of PL/Java are affected by CVE-2016-0766. If you are utilizing PL/Java in your PostgreSQL-9.1 database, it is important to take necessary measures to mitigate this privilege escalation vulnerability.
CVE-2016-0773 can result in denial of service attacks or the execution of arbitrary code by a remote attacker. It is critical to address this vulnerability promptly to prevent any potential compromise of the database system.
To upgrade your postgresql-9.1 packages, you can follow the standard package upgrade procedures provided by your operating system or distribution. Ensure that you install version 9.1.20-0+deb7u1 or a later version to address the identified vulnerabilities.
For more detailed information about these vulnerabilities, you can refer to the related CVE entries: CVE-2015-5288, CVE-2016-0766, and CVE-2016-0773. Additionally, you can consult the official documentation and security advisories provided by the PostgreSQL community.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-9.1.
