critique
CVE-2015-0244
postgresql: loss of frontend/backend protocol synchronization after an error
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.1AV:N/AC:H/Au:S/C:N/I:P/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Amazon (moyenne), Oracle (moyenne), Ubuntu (moyenne), Red Hat (faible).
Description
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | postgresql8, postgresql8-contrib, postgresql8-debuginfo et 31 autres | 8.4.20-2.48.amzn1 et 2 autres |
| debian 7 | postgresql-9.1 | 9.1.15-0+deb7u1 |
| Oracle Linux 6 | postgresql, postgresql-contrib, postgresql-devel et 7 autres | 8.4.20-2.el6_6 |
| Oracle Linux 7 | postgresql, postgresql-contrib, postgresql-devel et 8 autres | 9.2.10-2.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.15-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1, postgresql-9.3 | 9.1.15-0ubuntu0.14.04 et 1 autres |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.1-0ubuntu0.14.10 |
Afficher les 61 entrées de 8 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | postgresql8 | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-contrib | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-debuginfo | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-devel | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-docs | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-libs | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-plperl | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-plpython | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-pltcl | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-server | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-test | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql92 | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-contrib | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-debuginfo | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-devel | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-docs | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-libs | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-plperl | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-plpython | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-pltcl | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-server | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-server-compat | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-test | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql93 | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-contrib | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-debuginfo | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-devel | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-docs | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-libs | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-plperl | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-plpython | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-pltcl | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-server | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-test | 9.3.6-1.56.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.15-0+deb7u1 |
| Oracle Linux 6 | postgresql | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-server | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-test | 8.4.20-2.el6_6 |
| Oracle Linux 7 | postgresql | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-contrib | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-devel | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-docs | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-libs | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-plperl | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-plpython | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-server | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-test | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.10-2.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.15-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1 | 9.1.15-0ubuntu0.14.04 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.1-0ubuntu0.14.10 |
Références
- http://www.debian.org/security/2015/dsa-3155
- http://www.postgresql.org/about/news/1569/
- http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
- http://www.postgresql.org/docs/current/static/release-9-0-19.html
- http://www.postgresql.org/docs/current/static/release-9-1-15.html
- http://www.postgresql.org/docs/current/static/release-9-2-10.html
- http://www.postgresql.org/docs/current/static/release-9-3-6.html
- https://access.redhat.com/security/cve/CVE-2015-0244