CVE-2015-5288: Infoleak
The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5288?
CVE-2015-5288 has a high severity rating due to its potential to cause denial of service and facilitate memory read vulnerabilities.
How do I fix CVE-2015-5288?
To fix CVE-2015-5288, upgrade PostgreSQL to version 9.0.23, 9.1.19, 9.2.14, 9.3.10, or 9.4.5 or later.
What types of attacks can CVE-2015-5288 facilitate?
CVE-2015-5288 can facilitate denial of service attacks and unauthorized memory access on the PostgreSQL server.
Which versions of PostgreSQL are affected by CVE-2015-5288?
Versions of PostgreSQL affected by CVE-2015-5288 include all versions prior to 9.0.23, 9.1.19, 9.2.14, 9.3.10, and 9.4.5.
Is there a workaround for CVE-2015-5288 if I can't upgrade?
There is no official workaround for CVE-2015-5288; upgrading to a patched version is the recommended solution.