critical
CVE-2015-0244
postgresql: loss of frontend/backend protocol synchronization after an error
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.1AV:N/AC:H/Au:S/C:N/I:P/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Amazon (medium), Oracle (medium), Ubuntu (medium), Red Hat (low).
Description
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | postgresql8, postgresql8-contrib, postgresql8-debuginfo and 31 more | 8.4.20-2.48.amzn1 and 2 more |
| debian 7 | postgresql-9.1 | 9.1.15-0+deb7u1 |
| Oracle Linux 6 | postgresql, postgresql-contrib, postgresql-devel and 7 more | 8.4.20-2.el6_6 |
| Oracle Linux 7 | postgresql, postgresql-contrib, postgresql-devel and 8 more | 9.2.10-2.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.15-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1, postgresql-9.3 | 9.1.15-0ubuntu0.14.04 and 1 more |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.1-0ubuntu0.14.10 |
Show all 61 entries from 8 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | postgresql8 | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-contrib | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-debuginfo | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-devel | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-docs | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-libs | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-plperl | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-plpython | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-pltcl | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-server | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql8-test | 8.4.20-2.48.amzn1 |
| amazon linux 1 | postgresql92 | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-contrib | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-debuginfo | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-devel | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-docs | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-libs | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-plperl | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-plpython | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-pltcl | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-server | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-server-compat | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql92-test | 9.2.10-1.49.amzn1 |
| amazon linux 1 | postgresql93 | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-contrib | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-debuginfo | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-devel | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-docs | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-libs | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-plperl | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-plpython | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-pltcl | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-server | 9.3.6-1.56.amzn1 |
| amazon linux 1 | postgresql93-test | 9.3.6-1.56.amzn1 |
| debian 7 | postgresql-9.1 | 9.1.15-0+deb7u1 |
| Oracle Linux 6 | postgresql | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-contrib | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-devel | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-docs | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-libs | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-plperl | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-plpython | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-pltcl | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-server | 8.4.20-2.el6_6 |
| Oracle Linux 6 | postgresql-test | 8.4.20-2.el6_6 |
| Oracle Linux 7 | postgresql | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-contrib | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-devel | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-docs | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-libs | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-plperl | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-plpython | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-pltcl | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-server | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-test | 9.2.10-2.el7_1 |
| Oracle Linux 7 | postgresql-upgrade | 9.2.10-2.el7_1 |
| ubuntu 12.04 | postgresql-9.1 | 9.1.15-0ubuntu0.12.04 |
| ubuntu 14.04 | postgresql-9.1 | 9.1.15-0ubuntu0.14.04 |
| ubuntu 14.04 | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.04-ESM | postgresql-9.3 | 9.3.6-0ubuntu0.14.04 |
| ubuntu 14.10 | postgresql-9.4 | 9.4.1-0ubuntu0.14.10 |
References
- http://www.debian.org/security/2015/dsa-3155
- http://www.postgresql.org/about/news/1569/
- http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
- http://www.postgresql.org/docs/current/static/release-9-0-19.html
- http://www.postgresql.org/docs/current/static/release-9-1-15.html
- http://www.postgresql.org/docs/current/static/release-9-2-10.html
- http://www.postgresql.org/docs/current/static/release-9-3-6.html
- https://access.redhat.com/security/cve/CVE-2015-0244