CVE-2013-1900
First published: Thu Apr 04 2013(Updated: )
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PostgreSQL | =9.2 | |
| PostgreSQL | =9.2.1 | |
| PostgreSQL | =9.2.2 | |
| PostgreSQL | =9.2.3 | |
| PostgreSQL | =9.1 | |
| PostgreSQL | =9.1.1 | |
| PostgreSQL | =9.1.2 | |
| PostgreSQL | =9.1.3 | |
| PostgreSQL | =9.1.4 | |
| PostgreSQL | =9.1.5 | |
| PostgreSQL | =9.1.6 | |
| PostgreSQL | =9.1.7 | |
| PostgreSQL | =9.1.8 | |
| PostgreSQL | =9.0 | |
| PostgreSQL | =9.0.1 | |
| PostgreSQL | =9.0.2 | |
| PostgreSQL | =9.0.3 | |
| PostgreSQL | =9.0.4 | |
| PostgreSQL | =9.0.5 | |
| PostgreSQL | =9.0.6 | |
| PostgreSQL | =9.0.7 | |
| PostgreSQL | =9.0.8 | |
| PostgreSQL | =9.0.9 | |
| PostgreSQL | =9.0.10 | |
| PostgreSQL | =9.0.11 | |
| PostgreSQL | =9.0.12 | |
| PostgreSQL | =8.4 | |
| PostgreSQL | =8.4.1 | |
| PostgreSQL | =8.4.2 | |
| PostgreSQL | =8.4.3 | |
| PostgreSQL | =8.4.4 | |
| PostgreSQL | =8.4.5 | |
| PostgreSQL | =8.4.6 | |
| PostgreSQL | =8.4.7 | |
| PostgreSQL | =8.4.8 | |
| PostgreSQL | =8.4.9 | |
| PostgreSQL | =8.4.10 | |
| PostgreSQL | =8.4.11 | |
| PostgreSQL | =8.4.12 | |
| PostgreSQL | =8.4.13 | |
| PostgreSQL | =8.4.14 | |
| PostgreSQL | =8.4.15 | |
| PostgreSQL | =8.4.16 | |
| Ubuntu | =8.04 | |
| Ubuntu | =10.04 | |
| Ubuntu | =11.10 | |
| Ubuntu | =12.04 | |
| Ubuntu | =12.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html
- http://rhn.redhat.com/errata/RHSA-2013-1475.html
- http://support.apple.com/kb/HT5880
- http://support.apple.com/kb/HT5892
- http://www.debian.org/security/2013/dsa-2657
- http://www.debian.org/security/2013/dsa-2658
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.postgresql.org/about/news/1456/
- http://www.postgresql.org/docs/current/static/release-8-4-17.html
- http://www.postgresql.org/docs/current/static/release-9-0-13.html
- http://www.postgresql.org/docs/current/static/release-9-1-9.html
- http://www.postgresql.org/docs/current/static/release-9-2-4.html
- http://www.ubuntu.com/usn/USN-1789-1
Frequently Asked Questions
What is the severity of CVE-2013-1900?
CVE-2013-1900 has a medium severity level due to its potential impact on cryptographic functions.
How do I fix CVE-2013-1900?
To fix CVE-2013-1900, upgrade PostgreSQL to version 9.2.4, 9.1.9, 9.0.13, or 8.4.17 or later.
Who is affected by CVE-2013-1900?
CVE-2013-1900 affects PostgreSQL versions 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17 that use OpenSSL.
What are the potential impacts of CVE-2013-1900?
The potential impacts of CVE-2013-1900 include insufficient randomness in cryptographic functions, which may compromise security.
Is there a workaround for CVE-2013-1900?
There are no known effective workarounds for CVE-2013-1900 other than upgrading to a patched version of PostgreSQL.
- agent/type
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/postgresql
- canonical/postgresql
- version/postgresql/9.2
- version/postgresql/9.2.1
- version/postgresql/9.2.2
- version/postgresql/9.2.3
- version/postgresql/9.1
- version/postgresql/9.1.1
- version/postgresql/9.1.2
- version/postgresql/9.1.3
- version/postgresql/9.1.4
- version/postgresql/9.1.5
- version/postgresql/9.1.6
- version/postgresql/9.1.7
- version/postgresql/9.1.8
- version/postgresql/9.0
- version/postgresql/9.0.1
- version/postgresql/9.0.2
- version/postgresql/9.0.3
- version/postgresql/9.0.4
- version/postgresql/9.0.5
- version/postgresql/9.0.6
- version/postgresql/9.0.7
- version/postgresql/9.0.8
- version/postgresql/9.0.9
- version/postgresql/9.0.10
- version/postgresql/9.0.11
- version/postgresql/9.0.12
- version/postgresql/8.4
- version/postgresql/8.4.1
- version/postgresql/8.4.2
- version/postgresql/8.4.3
- version/postgresql/8.4.4
- version/postgresql/8.4.5
- version/postgresql/8.4.6
- version/postgresql/8.4.7
- version/postgresql/8.4.8
- version/postgresql/8.4.9
- version/postgresql/8.4.10
- version/postgresql/8.4.11
- version/postgresql/8.4.12
- version/postgresql/8.4.13
- version/postgresql/8.4.14
- version/postgresql/8.4.15
- version/postgresql/8.4.16
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/8.04
- version/ubuntu/10.04
- version/ubuntu/11.10
- version/ubuntu/12.04
- version/ubuntu/12.10