Cryptographic Issues The advisory has been revoked - it doesn't affect any version of package postgresql-9.1 (opens in a new tab)

Threat Intelligence

5.73% (93^rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU1304-POSTGRESQL91-646065
published5 Jul 2012
disclosed5 Jul 2012

Report a new vulnerability Found a mistake?

Introduced: 5 Jul 2012

CVE-2012-2143 (opens in a new tab) CWE-310 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:13.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream postgresql-9.1 package and not the postgresql-9.1 package as distributed by Ubuntu.

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.