CVE-2006-2314

2006-05-2410:06:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

postgresql

sql injection

security

cve-2006-2314

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.023 Low

EPSS

Percentile

89.6%

JSON

PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of “Encoding-Based SQL Injection.” NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem.

CPENameOperatorVersion
postgresql:postgresqlpostgresqleq8.0.7
postgresql:postgresqlpostgresqleq8.0.2
postgresql:postgresqlpostgresqleq7.3.3
postgresql:postgresqlpostgresqleq7.3
postgresql:postgresqlpostgresqleq8.1
postgresql:postgresqlpostgresqleq7.4.1
postgresql:postgresqlpostgresqleq7.3.9
postgresql:postgresqlpostgresqleq7.3.10
postgresql:postgresqlpostgresqleq8.1.3
postgresql:postgresqlpostgresqleq7.4.6

CPE	Name	Operator	Version
postgresql:postgresql	postgresql	eq	8.0.7
postgresql:postgresql	postgresql	eq	8.0.2
postgresql:postgresql	postgresql	eq	7.3.3
postgresql:postgresql	postgresql	eq	7.3
postgresql:postgresql	postgresql	eq	8.1
postgresql:postgresql	postgresql	eq	7.4.1
postgresql:postgresql	postgresql	eq	7.3.9
postgresql:postgresql	postgresql	eq	7.3.10
postgresql:postgresql	postgresql	eq	8.1.3
postgresql:postgresql	postgresql	eq	7.4.6