kritisch
CVE-2015-0244
postgresql: loss of frontend/backend protocol synchronization after an error
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.1AV:N/AC:H/Au:S/C:N/I:P/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Amazon (mittel), Oracle (mittel), Ubuntu (mittel), Red Hat (niedrig).
Beschreibung
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | postgresql8, postgresql8-contrib, postgresql8-debuginfo und 31 weitere | 8.4.20-2.48.amzn1 und 2 weitere |
| debian 7 | postgresql-9.1 | 9.1.15-0+deb7u1 |
| Oracle Linux 6 | postgresql, postgresql-contrib, postgresql-devel und 7 weitere | 8.4.20-2.el6_6 |
| Oracle Linux 7 | postgresql, postgresql-contrib, postgresql-devel und 8 weitere | 9.2.10-2.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.15-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1, postgresql-9.3 | 9.1.15-0ubuntu0.14.04 und 1 weitere |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.1-0ubuntu0.14.10 |
Alle 61 Einträge aus 8 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | postgresql8 | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-contrib | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-debuginfo | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-devel | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-docs | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-libs | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-plperl | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-plpython | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-pltcl | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-server | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-test | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql92 | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-contrib | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-debuginfo | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-devel | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-docs | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-libs | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-plperl | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-plpython | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-pltcl | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-server | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-server-compat | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-test | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql93 | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-contrib | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-debuginfo | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-devel | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-docs | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-libs | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-plperl | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-plpython | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-pltcl | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-server | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-test | 9.3.6-1.56.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.15-0+deb7u1 |
| Oracle Linux 6 | postgresql | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-server | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-test | 8.4.20-2.el6_6 |
| Oracle Linux 7 | postgresql | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-contrib | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-devel | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-docs | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-libs | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-plperl | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-plpython | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-server | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-test | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.10-2.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.15-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1 | 9.1.15-0ubuntu0.14.04 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.1-0ubuntu0.14.10 |
Referenzen
- http://www.debian.org/security/2015/dsa-3155
- http://www.postgresql.org/about/news/1569/
- http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
- http://www.postgresql.org/docs/current/static/release-9-0-19.html
- http://www.postgresql.org/docs/current/static/release-9-1-15.html
- http://www.postgresql.org/docs/current/static/release-9-2-10.html
- http://www.postgresql.org/docs/current/static/release-9-3-6.html
- https://access.redhat.com/security/cve/CVE-2015-0244