CVE-2015-3167
Published: 22 May 2015
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
Priority
Medium
CVSS 3 base score: 7.5
Status
| Package | Release | Status |
|---|---|---|
|
postgresql-8.4 Launchpad, Ubuntu, Debian |
precise |
Does not exist
(precise was needs-triage)
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| utopic |
Does not exist
|
|
| vivid |
Does not exist
|
|
| wily |
Does not exist
|
|
| xenial |
Does not exist
|
|
| yakkety |
Does not exist
|
|
| zesty |
Does not exist
|
|
|
postgresql-9.1 Launchpad, Ubuntu, Debian |
precise |
Released
(9.1.16-0ubuntu0.12.04)
|
| trusty |
Does not exist
(trusty was released [9.1.16-0ubuntu0.14.04])
|
|
| upstream |
Released
(9.1.16)
|
|
| utopic |
Does not exist
|
|
| vivid |
Does not exist
|
|
| wily |
Does not exist
|
|
| xenial |
Does not exist
|
|
| yakkety |
Does not exist
|
|
| zesty |
Does not exist
|
|
|
postgresql-9.3 Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
| trusty |
Released
(9.3.7-0ubuntu0.14.04)
|
|
| upstream |
Released
(9.3.7)
|
|
| utopic |
Does not exist
|
|
| vivid |
Does not exist
|
|
| wily |
Does not exist
|
|
| xenial |
Does not exist
|
|
| yakkety |
Does not exist
|
|
| zesty |
Does not exist
|
|
|
postgresql-9.4 Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
| trusty |
Does not exist
|
|
| upstream |
Released
(9.4.2)
|
|
| utopic |
Released
(9.4.2-0ubuntu0.14.10)
|
|
| vivid |
Released
(9.4.2-0ubuntu0.15.04)
|
|
| wily |
Released
(9.4.2-1)
|
|
| xenial |
Does not exist
|
|
| yakkety |
Does not exist
|
|
| zesty |
Does not exist
|