PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade postgresql-serverUpgrade postgresql-client | Dec 10, 2025 | Dec 17, 2009 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql. | Oct 30, 2017 | Dec 15, 2009 |
| Postgres | — | Upgrade to PostgreSQL version 8.1.19Upgrade to PostgreSQL version 8.4.2Upgrade to PostgreSQL version 8.3.9Upgrade to PostgreSQL version 8.2.15Upgrade to PostgreSQL version 8.0.23Upgrade to PostgreSQL version 7.4.27 | Feb 24, 2013 | Dec 15, 2009 |
| Suse | — | Upgrade postgresql93-contribUpgrade libpq5Upgrade postgresql10-contribUpgrade postgresql96Upgrade postgresql96-serverUpgrade postgresql94-contribUpgrade postgresql-libsUpgrade postgresqlUpgrade postgresql94-docsUpgrade postgresql10-serverUpgrade postgresql91-docsUpgrade postgresql-serverUpgrade libpq5-32bitUpgrade libecpg6Upgrade postgresql10Upgrade postgresql91-serverUpgrade postgresql93-serverUpgrade postgresql94-develUpgrade postgresql91-contribUpgrade postgresql96-docsUpgrade postgresql96-develUpgrade postgresql96-contribUpgrade postgresql94Upgrade postgresql10-develUpgrade postgresql-libs-32bitUpgrade postgresql10-plpythonUpgrade postgresql93-docsUpgrade postgresql93-develUpgrade postgresql93Upgrade postgresql10-docsUpgrade postgresql94-serverUpgrade postgresql10-plperlUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql91Upgrade postgresql10-pltclUpgrade postgresql-docsUpgrade postgresql-libs-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.4Upgrade postgresql-8.1 | Nov 8, 2024 | Dec 15, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub