PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade postgresql-serverUpgrade postgresql-client | Dec 10, 2025 | Dec 17, 2009 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server.Upgrade dev-db/postgresql-base.Upgrade dev-db/postgresql. | Oct 30, 2017 | Dec 15, 2009 |
| Postgres | — | Upgrade to PostgreSQL version 8.2.15Upgrade to PostgreSQL version 8.1.19Upgrade to PostgreSQL version 8.4.2Upgrade to PostgreSQL version 8.3.9Upgrade to PostgreSQL version 8.0.23Upgrade to PostgreSQL version 7.4.27 | Feb 24, 2013 | Dec 15, 2009 |
| Suse | — | Upgrade postgresql94-contribUpgrade libpq5-32bitUpgrade postgresql96-serverUpgrade libecpg6Upgrade postgresqlUpgrade postgresql10Upgrade postgresql10-serverUpgrade postgresql-libsUpgrade postgresql10-contribUpgrade postgresql94-docsUpgrade postgresql91-docsUpgrade postgresql96Upgrade postgresql-serverUpgrade postgresql93-contribUpgrade postgresql91-serverUpgrade libpq5Upgrade postgresql96-contribUpgrade postgresql94Upgrade postgresql10-pltclUpgrade postgresql10-docsUpgrade postgresql-libs-x86Upgrade postgresql-develUpgrade postgresql94-serverUpgrade postgresql10-develUpgrade postgresql91Upgrade postgresql10-plperlUpgrade postgresql91-contribUpgrade postgresql93-docsUpgrade postgresql-contribUpgrade postgresql-libs-32bitUpgrade postgresql96-develUpgrade postgresql93-develUpgrade postgresql93-serverUpgrade postgresql94-develUpgrade postgresql10-plpythonUpgrade postgresql93Upgrade postgresql96-docsUpgrade postgresql-docs | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-8.4Upgrade postgresql-8.1 | Nov 8, 2024 | Dec 15, 2009 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub