cve-2014-8161
Vulnerability from cvelistv5
Published
2020-01-27 15:29
Modified
2024-08-06 13:10
Severity
Summary
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
References
SourceURLTags
secalert@redhat.comhttp://www.debian.org/security/2015/dsa-3155Third Party Advisory
secalert@redhat.comhttp://www.postgresql.org/about/news/1569/Vendor Advisory
secalert@redhat.comhttp://www.postgresql.org/docs/9.4/static/release-9-4-1.htmlRelease Notes, Vendor Advisory
secalert@redhat.comhttp://www.postgresql.org/docs/current/static/release-9-0-19.htmlRelease Notes, Vendor Advisory
secalert@redhat.comhttp://www.postgresql.org/docs/current/static/release-9-1-15.htmlRelease Notes, Vendor Advisory
secalert@redhat.comhttp://www.postgresql.org/docs/current/static/release-9-2-10.htmlRelease Notes, Vendor Advisory
secalert@redhat.comhttp://www.postgresql.org/docs/current/static/release-9-3-6.htmlRelease Notes, Vendor Advisory
Impacted products
VendorProduct
PostgreSQL Global Development GroupPostgreSQL
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:10:51.110Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.postgresql.org/about/news/1569/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3155"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PostgreSQL",
          "vendor": "PostgreSQL Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "before 9.0.19"
            },
            {
              "status": "affected",
              "version": "9.1.x before 9.1.15"
            },
            {
              "status": "affected",
              "version": "9.2.x before 9.2.10"
            },
            {
              "status": "affected",
              "version": "9.3.x before 9.3.6"
            },
            {
              "status": "affected",
              "version": "9.4.x before 9.4.1"
            }
          ]
        }
      ],
      "datePublic": "2015-02-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-27T15:29:21",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.postgresql.org/about/news/1569/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3155"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2014-8161",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PostgreSQL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 9.0.19"
                          },
                          {
                            "version_value": "9.1.x before 9.1.15"
                          },
                          {
                            "version_value": "9.2.x before 9.2.10"
                          },
                          {
                            "version_value": "9.3.x before 9.3.6"
                          },
                          {
                            "version_value": "9.4.x before 9.4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PostgreSQL Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Path Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html"
            },
            {
              "name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html"
            },
            {
              "name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html"
            },
            {
              "name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html"
            },
            {
              "name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html"
            },
            {
              "name": "http://www.postgresql.org/about/news/1569/",
              "refsource": "CONFIRM",
              "url": "http://www.postgresql.org/about/news/1569/"
            },
            {
              "name": "http://www.debian.org/security/2015/dsa-3155",
              "refsource": "CONFIRM",
              "url": "http://www.debian.org/security/2015/dsa-3155"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-8161",
    "datePublished": "2020-01-27T15:29:21",
    "dateReserved": "2014-10-10T00:00:00",
    "dateUpdated": "2024-08-06T13:10:51.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-8161\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2020-01-27T16:15:10.063\",\"lastModified\":\"2020-01-31T15:24:43.387\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.\"},{\"lang\":\"es\",\"value\":\"PostgreSQL versiones anteriores a 9.0.19, versiones 9.1.x anteriores a 9.1.15, versiones 9.2.x anteriores a 9.2.10, versiones 9.3.x anteriores a 9.3.6 y versiones 9.4.x anteriores a 9.4.1, permite a usuarios autenticados remotos obtener valores de columna confidenciales mediante la violaci\u00f3n de restricciones y luego leer el mensaje de error.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.0.19\",\"matchCriteriaId\":\"8521B330-9A5E-4F15-A6F5-CFF8624F6C66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.1.0\",\"versionEndExcluding\":\"9.1.15\",\"matchCriteriaId\":\"9323DC39-ED96-4A57-AEB7-9E87FF1889A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.2.0\",\"versionEndExcluding\":\"9.2.10\",\"matchCriteriaId\":\"E2A0FAC5-671F-4895-9A93-BB1BC98A2468\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.3.0\",\"versionEndExcluding\":\"9.3.6\",\"matchCriteriaId\":\"77B357E3-1440-4630-8B79-B5629F8E40D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.4.0\",\"versionEndExcluding\":\"9.4.1\",\"matchCriteriaId\":\"D74C01C3-5369-4885-9D6F-69E638FE73BE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://www.debian.org/security/2015/dsa-3155\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.postgresql.org/about/news/1569/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.postgresql.org/docs/9.4/static/release-9-4-1.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.postgresql.org/docs/current/static/release-9-0-19.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.postgresql.org/docs/current/static/release-9-1-15.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.postgresql.org/docs/current/static/release-9-2-10.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.postgresql.org/docs/current/static/release-9-3-6.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.