PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql84-plpythonUpgrade postgresql-plperlUpgrade postgresql-docsUpgrade postgresql84-plperlUpgrade postgresql84-libsUpgrade postgresql-testUpgrade postgresql84-testUpgrade postgresql84-contribUpgrade postgresql84-tclUpgrade postgresql84-docsUpgrade postgresql84-pythonUpgrade postgresql84-pltclUpgrade postgresql-plpythonUpgrade postgresql84-serverUpgrade postgresql-develUpgrade postgresql84-develUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql84 | Dec 1, 2016 | Jul 18, 2012 |
| Freebsd | — | Upgrade postgresql-client | Dec 10, 2025 | Feb 28, 2012 |
| Gentoo Linux | — | Upgrade dev-db/postgresql-server. | Oct 30, 2017 | Jul 18, 2012 |
| Oracle_linux | — | Upgrade postgresql84-plperlUpgrade postgresql84-plpythonUpgrade postgresql-pltclUpgrade postgresql84-serverUpgrade postgresql84-pythonUpgrade postgresqlUpgrade postgresql-libsUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql84-libsUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql84-contribUpgrade postgresql84-docsUpgrade postgresql84-pltclUpgrade postgresql84-tclUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql84Upgrade postgresql84-testUpgrade postgresql84-devel | Oct 16, 2024 | Jul 18, 2012 |
| Postgres | — | Upgrade to PostgreSQL version 9.0.7Upgrade to PostgreSQL version 9.1.3Upgrade to PostgreSQL version 8.4.11 | Feb 24, 2013 | Jul 18, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2012 |
| Suse | — | Upgrade postgresql10-contribUpgrade libecpg6Upgrade postgresql10-serverUpgrade postgresql93-contribUpgrade postgresql94-docsUpgrade postgresql10-develUpgrade postgresql10Upgrade postgresql94-contribUpgrade postgresql96Upgrade postgresql96-develUpgrade libpq5Upgrade postgresql96-serverUpgrade postgresql93-docsUpgrade postgresql94-serverUpgrade postgresql10-pltclUpgrade postgresql94Upgrade postgresql10-plpythonUpgrade postgresql10-plperlUpgrade postgresql93-serverUpgrade libpq5-32bitUpgrade postgresql93-develUpgrade postgresql96-contribUpgrade postgresql96-docsUpgrade postgresql93Upgrade postgresql94-develUpgrade postgresql10-docs | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade postgresql-8.3Upgrade postgresql-9.1Upgrade postgresql-8.4 | Nov 8, 2024 | Jul 18, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub