In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
CVSS Details
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresql15Upgrade postgresql | Aug 30, 2017 | May 12, 2017 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql93Upgrade postgresql94 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 12, 2017 |
| Debian | — | Upgrade postgresql-9.6 | May 13, 2017 | May 12, 2017 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Oct 30, 2017 | May 12, 2017 |
| Postgres | — | Upgrade to PostgreSQL version 9.4.12Upgrade to PostgreSQL version 9.3.17Upgrade to PostgreSQL version 9.5.7Upgrade to PostgreSQL version 9.6.3 | May 15, 2017 | May 12, 2017 |
| Suse | — | Upgrade postgresql96-contribUpgrade libpq5-32bitUpgrade postgresql94-develUpgrade postgresql96Upgrade postgresql94-contribUpgrade libecpg6Upgrade postgresql10-plperlUpgrade postgresql93Upgrade postgresql10-plpythonUpgrade postgresql96-develUpgrade postgresql94-docsUpgrade postgresql10-docsUpgrade postgresql10-develUpgrade postgresql96-serverUpgrade postgresql96-docsUpgrade postgresql94Upgrade postgresql93-docsUpgrade postgresql10-pltclUpgrade libpq5Upgrade postgresql93-serverUpgrade postgresql94-serverUpgrade postgresql10Upgrade postgresql93-contribUpgrade postgresql10-serverUpgrade postgresql10-contrib | May 31, 2017 | May 12, 2017 |
| Ubuntu | — | Upgrade postgresql-9.3Upgrade postgresql-9.6Upgrade postgresql-9.5 | Nov 19, 2024 | May 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub