Multiple vulnerabilities in PostgreSQL

Описание

Multiple serious vulnerabilities have been found in PostgreSQL. Malicious users can exploit these vulnerabilities to cause denial of service or obtain sensitive information.

Below is a complete list of vulnerabilities

1. An unknown vulnerability can be exploited via a specially designed user input to cause denial of service;
2. An unknown vulnerability at pgCrypto can be exploited to obtain sensitive information.

---

Technical details

Vulnerability (1) caused by erroneous json or jsonb construction from input.

(2) caused by crypt function and can be triggered via ‘too-short’ salt to read arbitrary server memory.

Первичный источник обнаружения

• Release note
  

Связанные продукты

• PostgreSQL

Список CVE

• CVE-2015-5289
  high
• CVE-2015-5288
  high

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com