CVE-2013-1900: High severity postgresql vulnerability

Published Apr 4, 2013

Updated

PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."

Affected Software

48 affected components

PostgreSQL postgresql=9.2

PostgreSQL postgresql=9.2.1

PostgreSQL postgresql=9.2.2

PostgreSQL postgresql=9.2.3

PostgreSQL postgresql=9.1

PostgreSQL postgresql=9.1.1

PostgreSQL postgresql=9.1.2

PostgreSQL postgresql=9.1.3

PostgreSQL postgresql=9.1.4

PostgreSQL postgresql=9.1.5

PostgreSQL postgresql=9.1.6

PostgreSQL postgresql=9.1.7

PostgreSQL postgresql=9.1.8

PostgreSQL postgresql=9.0

PostgreSQL postgresql=9.0.1

PostgreSQL postgresql=9.0.2

PostgreSQL postgresql=9.0.3

PostgreSQL postgresql=9.0.4

PostgreSQL postgresql=9.0.5

PostgreSQL postgresql=9.0.6

PostgreSQL postgresql=9.0.7

PostgreSQL postgresql=9.0.8

PostgreSQL postgresql=9.0.9

PostgreSQL postgresql=9.0.10

PostgreSQL postgresql=9.0.11

PostgreSQL postgresql=9.0.12

PostgreSQL postgresql=8.4

PostgreSQL postgresql=8.4.1

PostgreSQL postgresql=8.4.2

PostgreSQL postgresql=8.4.3

PostgreSQL postgresql=8.4.4

PostgreSQL postgresql=8.4.5

PostgreSQL postgresql=8.4.6

PostgreSQL postgresql=8.4.7

PostgreSQL postgresql=8.4.8

PostgreSQL postgresql=8.4.9

PostgreSQL postgresql=8.4.10

PostgreSQL postgresql=8.4.11

PostgreSQL postgresql=8.4.12

PostgreSQL postgresql=8.4.13

PostgreSQL postgresql=8.4.14

PostgreSQL postgresql=8.4.15

PostgreSQL postgresql=8.4.16

Canonical Ubuntu Linux=8.04

Canonical Ubuntu Linux=10.04

Canonical Ubuntu Linux=11.10

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=12.10

Event History

Apr 4, 2013

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1900?

CVE-2013-1900 has a medium severity level due to its potential impact on cryptographic functions.

How do I fix CVE-2013-1900?

To fix CVE-2013-1900, upgrade PostgreSQL to version 9.2.4, 9.1.9, 9.0.13, or 8.4.17 or later.

Who is affected by CVE-2013-1900?

CVE-2013-1900 affects PostgreSQL versions 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17 that use OpenSSL.

What are the potential impacts of CVE-2013-1900?

The potential impacts of CVE-2013-1900 include insufficient randomness in cryptographic functions, which may compromise security.

Is there a workaround for CVE-2013-1900?

There are no known effective workarounds for CVE-2013-1900 other than upgrading to a patched version of PostgreSQL.