NVD Vulnerability Detail

CVE-2015-0244

Summary	PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Publication Date	Jan. 28, 2020, 1:15 a.m.
Registration Date	Jan. 26, 2021, 2:43 p.m.
Last Update	Nov. 21, 2024, 11:22 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.debian.org/security/2015/dsa-3155	Third Party Advisory
2	http://www.debian.org/security/2015/dsa-3155	Third Party Advisory
3	http://www.postgresql.org/about/news/1569/	Vendor Advisory
4	http://www.postgresql.org/about/news/1569/	Vendor Advisory
5	http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	Release Notes Vendor Advisory
6	http://www.postgresql.org/docs/9.4/static/release-9-4-1.html	Release Notes Vendor Advisory
7	http://www.postgresql.org/docs/current/static/release-9-0-19.html	Release Notes Vendor Advisory
8	http://www.postgresql.org/docs/current/static/release-9-0-19.html	Release Notes Vendor Advisory
9	http://www.postgresql.org/docs/current/static/release-9-1-15.html	Release Notes Vendor Advisory
10	http://www.postgresql.org/docs/current/static/release-9-1-15.html	Release Notes Vendor Advisory
11	http://www.postgresql.org/docs/current/static/release-9-2-10.html	Release Notes Vendor Advisory
12	http://www.postgresql.org/docs/current/static/release-9-2-10.html	Release Notes Vendor Advisory
13	http://www.postgresql.org/docs/current/static/release-9-3-6.html	Release Notes Vendor Advisory
14	http://www.postgresql.org/docs/current/static/release-9-3-6.html	Release Notes Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

PostgreSQL における SQL インジェクションの脆弱性

Title	PostgreSQL における SQL インジェクションの脆弱性
Summary	PostgreSQL には、SQL インジェクションの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 5, 2015, midnight
Registration Date	Feb. 14, 2020, 11:08 a.m.
Last Update	Feb. 14, 2020, 11:08 a.m.

Affected System

PostgreSQL.org

PostgreSQL 9.0.19 未満

PostgreSQL 9.1.15 未満の 9.1.x

PostgreSQL 9.2.10 未満の 9.2.x

PostgreSQL 9.3.6 未満の 9.3.x

PostgreSQL 9.4.1 未満の 9.4.x

Debian

Debian GNU/Linux

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-0244	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0244
National Vulnerability Database (NVD)
2	CVE-2015-0244	https://nvd.nist.gov/vuln/detail/CVE-2015-0244

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3155	http://www.debian.org/security/2015/dsa-3155
PostgreSQL NEWS
2	PostgreSQL 9.4.1, 9.3.6, 9.2.10, 9.1.15 & 9.0.19 Released	http://www.postgresql.org/about/news/1569/
PostgreSQL Release Notes
3	E.10. Release 9.1.15	http://www.postgresql.org/docs/current/static/release-9-1-15.html
4	E.15. Release 9.2.10	http://www.postgresql.org/docs/current/static/release-9-2-10.html
5	E.20. Release 9.3.6	http://www.postgresql.org/docs/current/static/release-9-3-6.html
6	E.25. Release 9.4.1	http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
7	E.5. Release 9.0.19	http://www.postgresql.org/docs/current/static/release-9-0-19.html

Change Log

No	Changed Details	Date of change
1	[2020年02月14日] 掲載	Feb. 14, 2020, 11:08 a.m.