Lucene search

RedhatCVE-2015-3167

HistoryNov 20, 2019 - 9:15 p.m.

CVE-2015-3167

2019-11-2021:15:11

CWE-200

redhat

web.nvd.nist.gov

163

postgresql

security vulnerability

cve-2015-3167

nvd

brute force attack

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

8.1

Confidence

High

EPSS

0.006

Percentile

78.4%

JSON

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

Affected configurations

Nvd

Vulners

Node

postgresqlpostgresqlRange<9.0.20

postgresqlpostgresqlRange9.1–9.1.16

postgresqlpostgresqlRange9.2–9.2.11

postgresqlpostgresqlRange9.3–9.3.7

postgresqlpostgresqlRange9.4–9.4.2

Node

debiandebian_linuxMatch7.0

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

Node

canonicalubuntu_linuxMatch12.04lts

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch14.10

canonicalubuntu_linuxMatch15.04

VendorProductVersionCPE
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
debiandebian_linux7.0cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
canonicalubuntu_linux12.04cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
canonicalubuntu_linux14.10cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
canonicalubuntu_linux15.04cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::
debian	debian_linux	7.0	cpe:2.3:o:debian:debian_linux:7.0:::::::*
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*
canonical	ubuntu_linux	12.04	cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
canonical	ubuntu_linux	14.04	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
canonical	ubuntu_linux	14.10	cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*
canonical	ubuntu_linux	15.04	cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*

CNA Affected

[
  {
    "product": "PostgreSQL",
    "vendor": "PostgreSQL Global Development Group",
    "versions": [
      {
        "status": "affected",
        "version": "before 9.0.20"
      },
      {
        "status": "affected",
        "version": "9.1.x before 9.1.16"
      },
      {
        "status": "affected",
        "version": "9.2.x before 9.2.11"
      },
      {
        "status": "affected",
        "version": "9.3.x before 9.3.7"
      },
      {
        "status": "affected",
        "version": "and 9.4.x before 9.4.2"
      }
    ]
  }
]