Is CVE-2006-2314 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 3%.

What products does CVE-2006-2314 affect?

Tracked products affected include PostgreSQL. Check the version you run to see whether it is affected.

How do I fix CVE-2006-2314?

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2006-2314

Q: What is CVE-2006-2314?

CVE-2006-2314 is a high-severity software vulnerability with a CVSS score of 7.5. PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings tha

HIGH severity · CVSS 7.5

7.5CVSS HIGH

Summary

PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)3%

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products we track (1)

PostgreSQL

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: http://archives.postgresql.org/pgsql-announce/2006-05/msg00010.php ↗

CVE-2006-2314

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information