CVE-2015-3167: Infoleak
contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-3167?
CVE-2015-3167 is a vulnerability in PostgreSQL versions before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 that allows attackers to obtain encryption keys via a brute force attack.
What is the severity of CVE-2015-3167?
The severity of CVE-2015-3167 is high, with a CVSS score of 7.5.
How can I fix CVE-2015-3167?
To fix CVE-2015-3167, you should update your PostgreSQL installation to version 9.0.20, 9.1.16, 9.2.11, 9.3.7, or 9.4.2.
Is there any reference for CVE-2015-3167?
Yes, you can find more information about CVE-2015-3167 in the following references: http://ubuntu.com/usn/usn-2621-1, http://www.debian.org/security/2015/dsa-3269, http://www.debian.org/security/2015/dsa-3270.
What is the Common Weakness Enumeration (CWE) ID for CVE-2015-3167?
The CWE ID for CVE-2015-3167 is CWE-200.