Описание
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| pgbouncer | fixed | 1.6.1-1 | package | |
| pgbouncer | not-affected | jessie | package | |
| pgbouncer | not-affected | wheezy | package | |
| pgbouncer | not-affected | squeeze | package |
Примечания
http://web.archive.org/web/20150905195759/http://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/
https://github.com/pgbouncer/pgbouncer/issues/69
https://www.openwall.com/lists/oss-security/2015/09/04/3
EPSS
Связанные уязвимости
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
EPSS