CVE-2006-2313: SQL Injection

Published May 24, 2006

Updated

PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications via invalid encodings of multibyte characters, aka one variant of "Encoding-Based SQL Injection."

Affected Software

40 affected components

PostgreSQL postgresql=7.3

PostgreSQL postgresql=7.3.1

PostgreSQL postgresql=7.3.2

PostgreSQL postgresql=7.3.3

PostgreSQL postgresql=7.3.4

PostgreSQL postgresql=7.3.5

PostgreSQL postgresql=7.3.6

PostgreSQL postgresql=7.3.7

PostgreSQL postgresql=7.3.8

PostgreSQL postgresql=7.3.9

PostgreSQL postgresql=7.3.10

PostgreSQL postgresql=7.3.11

PostgreSQL postgresql=7.3.12

PostgreSQL postgresql=7.3.13

PostgreSQL postgresql=7.3.14

PostgreSQL postgresql=7.4

PostgreSQL postgresql=7.4.1

PostgreSQL postgresql=7.4.2

PostgreSQL postgresql=7.4.3

PostgreSQL postgresql=7.4.4

PostgreSQL postgresql=7.4.5

PostgreSQL postgresql=7.4.6

PostgreSQL postgresql=7.4.7

PostgreSQL postgresql=7.4.8

PostgreSQL postgresql=7.4.9

PostgreSQL postgresql=7.4.10

PostgreSQL postgresql=7.4.11

PostgreSQL postgresql=7.4.12

PostgreSQL postgresql=8.0

PostgreSQL postgresql=8.0.1

PostgreSQL postgresql=8.0.2

PostgreSQL postgresql=8.0.3

PostgreSQL postgresql=8.0.4

PostgreSQL postgresql=8.0.5

PostgreSQL postgresql=8.0.6

PostgreSQL postgresql=8.0.7

PostgreSQL postgresql=8.1

PostgreSQL postgresql=8.1.1

PostgreSQL postgresql=8.1.2

PostgreSQL postgresql=8.1.3

Remediation

Patch Available

http://archives.postgresql.org/pgsql-announce/2006-05/msg00010.php

Event History

May 24, 2006

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-2313?

CVE-2006-2313 is considered a medium severity vulnerability due to its potential impact on SQL injection defenses.

How do I fix CVE-2006-2313?

To mitigate CVE-2006-2313, upgrade PostgreSQL to version 8.1.4 or later, or any affected version to its corresponding patched release.

What versions are affected by CVE-2006-2313?

CVE-2006-2313 affects PostgreSQL versions 7.4.x before 7.4.13, 7.3.x before 7.3.15, 8.0.x before 8.0.8, and 8.1.x before 8.1.4.

What type of attack is CVE-2006-2313 associated with?

CVE-2006-2313 is associated with SQL injection attacks that exploit invalid encodings of multibyte characters.

Are there any workarounds for CVE-2006-2313?

There are no effective workarounds for CVE-2006-2313 other than patching to a secure version of PostgreSQL.