Description

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

Remediation

References

CVE-2015-3167

Related Vulnerabilities

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-0218)

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-16863)

WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-35301)

WordPress Plugin Funnel Builder by CartFlows-Create High Converting Sales Funnels For WordPress Cross-Site Request Forgery (1.5.15)

WordPress Plugin LOGOSWARE SUITE Uploader Arbitrary File Upload (1.1.6)

Severity

High

Classification

CVE-2015-3167 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities