Description

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

Remediation

References

CVE-2015-3167

Related Vulnerabilities

Magento Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-8130)

WordPress Plugin 404 to 301-Redirect, Log and Notify 404 Errors Cross-Site Request Forgery (3.0.8)

MySQL CVE-2024-20971 Vulnerability (CVE-2024-20971)

Serendipity Improper Access Control Vulnerability (CVE-2016-10082)

MySQL CVE-2020-2895 Vulnerability (CVE-2020-2895)

Severity

High

Classification

CVE-2015-3167 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities