gsd-2014-8161
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2014-8161", "description": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.", "id": "GSD-2014-8161", "references": [ "https://www.suse.com/security/cve/CVE-2014-8161.html", "https://www.debian.org/security/2015/dsa-3155", "https://access.redhat.com/errata/RHSA-2015:0856", "https://access.redhat.com/errata/RHSA-2015:0750", "https://access.redhat.com/errata/RHSA-2015:0699", "https://ubuntu.com/security/CVE-2014-8161", "https://advisories.mageia.org/CVE-2014-8161.html", "https://alas.aws.amazon.com/cve/html/CVE-2014-8161.html", "https://linux.oracle.com/cve/CVE-2014-8161.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2014-8161" ], "details": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.", "id": "GSD-2014-8161", "modified": "2023-12-13T01:22:49.297224Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-8161", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "PostgreSQL", "version": { "version_data": [ { "version_value": "before 9.0.19" }, { "version_value": "9.1.x before 9.1.15" }, { "version_value": "9.2.x before 9.2.10" }, { "version_value": "9.3.x before 9.3.6" }, { "version_value": "9.4.x before 9.4.1" } ] } } ] }, "vendor_name": "PostgreSQL Global Development Group" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Path Disclosure" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html", "refsource": "CONFIRM", "url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html", "refsource": "CONFIRM", "url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html", "refsource": "CONFIRM", "url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html", "refsource": "CONFIRM", "url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html", "refsource": "CONFIRM", "url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html" }, { "name": "http://www.postgresql.org/about/news/1569/", "refsource": "CONFIRM", "url": "http://www.postgresql.org/about/news/1569/" }, { "name": "http://www.debian.org/security/2015/dsa-3155", "refsource": "CONFIRM", "url": "http://www.debian.org/security/2015/dsa-3155" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.0.19", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.1.15", "versionStartIncluding": "9.1.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.2.10", "versionStartIncluding": "9.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.3.6", "versionStartIncluding": "9.3.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "9.4.1", "versionStartIncluding": "9.4.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-8161" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-209" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.postgresql.org/about/news/1569/", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "http://www.postgresql.org/about/news/1569/" }, { "name": "http://www.debian.org/security/2015/dsa-3155", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "http://www.debian.org/security/2015/dsa-3155" }, { "name": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html", "refsource": "CONFIRM", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "http://www.postgresql.org/docs/9.4/static/release-9-4-1.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-2-10.html", "refsource": "CONFIRM", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "http://www.postgresql.org/docs/current/static/release-9-2-10.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-0-19.html", "refsource": "CONFIRM", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "http://www.postgresql.org/docs/current/static/release-9-0-19.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-1-15.html", "refsource": "CONFIRM", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "http://www.postgresql.org/docs/current/static/release-9-1-15.html" }, { "name": "http://www.postgresql.org/docs/current/static/release-9-3-6.html", "refsource": "CONFIRM", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "http://www.postgresql.org/docs/current/static/release-9-3-6.html" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 1.4 } }, "lastModifiedDate": "2020-01-31T15:24Z", "publishedDate": "2020-01-27T16:15Z" } } }
Loading...