In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
CVSS Details
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-postgresqlalpine-linux-upgrade-postgresql14alpine-linux-upgrade-postgresql15 | Aug 30, 2017 | May 12, 2017 | |
| Amazon_linux | — | amazon-linux-upgrade--postgresql94amazon-linux-upgrade--postgresql95amazon-linux-upgrade-postgresql93 | Jun 7, 2017 | May 12, 2017 |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | May 12, 2017 | |
| Debian | debian-upgrade-postgresql-9-6 | May 13, 2017 | May 12, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-db-postgresql | Oct 30, 2017 | May 12, 2017 | |
| Postgres | postgres-upgrade-9_3_17postgres-upgrade-9_4_12postgres-upgrade-9_5_7postgres-upgrade-9_6_3 | May 15, 2017 | May 12, 2017 | |
| Suse | — | suse-upgrade-libecpg6suse-upgrade-libpq5suse-upgrade-libpq5-32bitsuse-upgrade-postgresql10suse-upgrade-postgresql10-contribsuse-upgrade-postgresql10-develsuse-upgrade-postgresql10-docssuse-upgrade-postgresql10-plperlsuse-upgrade-postgresql10-plpythonsuse-upgrade-postgresql10-pltclsuse-upgrade-postgresql10-serversuse-upgrade-postgresql93suse-upgrade-postgresql93-contribsuse-upgrade-postgresql93-docssuse-upgrade-postgresql93-serversuse-upgrade-postgresql94suse-upgrade-postgresql94-contribsuse-upgrade-postgresql94-develsuse-upgrade-postgresql94-docssuse-upgrade-postgresql94-serversuse-upgrade-postgresql96suse-upgrade-postgresql96-contribsuse-upgrade-postgresql96-develsuse-upgrade-postgresql96-docssuse-upgrade-postgresql96-server | May 31, 2017 | May 12, 2017 |
| Ubuntu | ubuntu-upgrade-postgresql-9-3ubuntu-upgrade-postgresql-9-5ubuntu-upgrade-postgresql-9-6 | Nov 19, 2024 | May 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub