PT-2017-3883 · Postgresql+1 · Postgresql+1

Daniel Gustafsson · Published 2017-05-08 · Updated 2026-01-30 · CVE-2017-7485

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.3.x through 9.3.16 PostgreSQL versions 9.4.x through 9.4.11 PostgreSQL versions 9.5.x through 9.5.6 PostgreSQL versions 9.6.x through 9.6.2

Description The issue is related to the libpq library in the PostgreSQL database management system, where the lack of enforced TLS connection usage is a concern. This could allow a remote attacker to perform a Man-in-the-Middle attack, potentially stripping the SSL/TLS protection from a connection between a client and a server. The PGREQUIRESSL environment variable was found to no longer enforce a SSL/TLS connection to a PostgreSQL server.

Recommendations For PostgreSQL versions 9.3.x through 9.3.16, update to version 9.3.17 or later. For PostgreSQL versions 9.4.x through 9.4.11, update to version 9.4.12 or later. For PostgreSQL versions 9.5.x through 9.5.6, update to version 9.5.7 or later. For PostgreSQL versions 9.6.x through 9.6.2, update to version 9.6.3 or later.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-390

CWE-311

Related Identifiers

BDU:2019-04174

CLEANSTART-2026-FW42039

CLEANSTART-2026-HJ04971

CVE-2017-7485

DSA-3851-1

MGASA-2017-0230

RHSA-2017:1677

RHSA-2017:1678

RHSA-2017:1838

RHSA-2017:2425

SUSE-SU-2017:1441-1

SUSE-SU-2017:1690-1

SUSE-SU-2017:1783-1

Affected Products

Postgresql

Suse

References · 120

• https://nvd.nist.gov/vuln/detail/CVE-2023-2455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7547 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3677 · Security Note
• https://access.redhat.com/errata/RHSA-2017:1677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25694 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7485 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-23214 · Security Note
• https://debian.org/security/2017/dsa-3851.ru.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-51477 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-7485 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1441-1 · Vendor Advisory
• https://postgresql.org/about/news/1746 · Vendor Advisory