PT-2017-3883 · Postgresql+1 · Postgresql+1

Daniel Gustafsson · Publicado 2017-05-08 · Atualizado 2026-01-30 · CVE-2017-7485

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.3.x through 9.3.16 PostgreSQL versions 9.4.x through 9.4.11 PostgreSQL versions 9.5.x through 9.5.6 PostgreSQL versions 9.6.x through 9.6.2

Description The issue is related to the libpq library in the PostgreSQL database management system, where the lack of enforced TLS connection usage is a concern. This could allow a remote attacker to perform a Man-in-the-Middle attack, potentially stripping the SSL/TLS protection from a connection between a client and a server. The PGREQUIRESSL environment variable was found to no longer enforce a SSL/TLS connection to a PostgreSQL server.

Recommendations For PostgreSQL versions 9.3.x through 9.3.16, update to version 9.3.17 or later. For PostgreSQL versions 9.4.x through 9.4.11, update to version 9.4.12 or later. For PostgreSQL versions 9.5.x through 9.5.6, update to version 9.5.7 or later. For PostgreSQL versions 9.6.x through 9.6.2, update to version 9.6.3 or later.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-390

CWE-311

Identificadores relacionados

BDU:2019-04174

CLEANSTART-2026-FW42039

CLEANSTART-2026-HJ04971

CVE-2017-7485

DSA-3851-1

MGASA-2017-0230

RHSA-2017:1677

RHSA-2017:1678

RHSA-2017:1838

RHSA-2017:2425

SUSE-SU-2017:1441-1

SUSE-SU-2017:1690-1

SUSE-SU-2017:1783-1

Produtos afetados

Postgresql

Suse

Referências · 120

• https://github.com/postgres/postgres/commit/0170b10 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FW42039 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FW42039.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HJ04971 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HJ04971.json · Nota
• https://postgresql.org/about/news/2017-05-11-security-update-release-1746 · Nota
• https://osv.dev/vulnerability/CVE-2017-7547 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2455 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7546 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7547 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7548 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-3677 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:1677 · Aviso do Fabricante
• https://bugzilla.suse.com/1037624 · Nota
• https://osv.dev/vulnerability/CVE-2020-25694 · Nota