PT-2012-2920 · Postgresql+2 · Postgresql+2

Heikki Linnakangas · Published 2012-05-21 · Updated 2024-06-15 · CVE-2012-0867

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.4.x through 8.4.10 PostgreSQL versions 9.0.x through 9.0.6 PostgreSQL versions 9.1.x through 9.1.2

Description The issue allows remote attackers to spoof connections when the host name is exactly 32 characters, due to the truncation of the common name to only 32 characters in SSL certificate verification. This can occur under certain circumstances, particularly when using third-party certificate authorities.

Recommendations For PostgreSQL versions 8.4.x through 8.4.10, update to version 8.4.11 or later. For PostgreSQL versions 9.0.x through 9.0.6, update to version 9.0.7 or later. For PostgreSQL versions 9.1.x through 9.1.2, update to version 9.1.3 or later.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-20

CWE-295

Related Identifiers

CESA-2012_0678

CVE-2012-0867

DSA-2418-1

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

RHSA-2012:0678

RHSA-2012_0678

Affected Products

Centos

Postgresql

Red Hat

References · 72

• https://linux.oracle.com/errata/ELSA-2012-0678.html · Vendor Advisory
• http://postgresql.org/docs/9.0/static/release-9-0-7.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10030-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0866 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:026 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0678.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0868 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10256-1 · Vendor Advisory
• http://debian.org/security/2012/dsa-2418 · Vendor Advisory
• http://postgresql.org/about/news/1377 · Vendor Advisory
• http://postgresql.org/docs/8.4/static/release-8-4-11.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0867 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0867 · Security Note