Ubuntu 11.04 USN-1229-1 Critical: PostgreSQL Blowfish Flaw

ubuntu

October 13, 2011

PostgreSQL incorrectly handled blowfish passwords.

Summary

PostgreSQL incorrectly handled blowfish passwords.

Software Description:

- postgresql-8.4: Object-relational SQL database

- postgresql-8.3: Object-relational SQL database

Details:

It was discovered that the blowfish algorithm in the pgcrypto module

incorrectly handled certain 8-bit characters, resulting in the password

hashes being easier to crack than expected. An attacker who could obtain

the password hashes would be able to recover the plaintext with less

effort.

Topics Covered

security advisory security issue critical ubuntu database postgresql password flaw

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  postgresql-8.4                  8.4.9-0ubuntu0.11.04

Ubuntu 10.10:
  postgresql-8.4                  8.4.9-0ubuntu0.10.10

Ubuntu 10.04 LTS:
  postgresql-8.4                  8.4.9-0ubuntu0.10.04

Ubuntu 8.04 LTS:
  postgresql-8.3                  8.3.16-0ubuntu0.8.04

In general, a standard system update will make all the necessary changes.