Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2012-0867: PostgreSQL older versions may accept fake SSL connections
CVE-2012-0867 · published 14 years ago
Summary
Versions of PostgreSQL 8.4, 9.0 and 9.1 before their latest updates can mistakenly cut the server name in a security certificate to 32 characters when checking it. If the real host name is exactly 32 characters, an attacker could pretend to be the legitimate server. Upgrade PostgreSQL to the newest release or apply the provided patches to fix the check.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| opensuse_project | opensuse |
12.2 cpe:2.3:o:opensuse_project:opensuse:12.2:*:*:*:*:*:*:* |
| postgresql | postgresql |
8.4 8.4.1 8.4.2 8.4.3 8.4.4 8.4.5 8.4.6 8.4.7 8.4.8 8.4.9 8.4.10 9.0 9 more version ranges
cpe:2.3:a:postgresql:postgresql:8.4:*:*:*:*:*:*:* |
| debian | debian_linux |
6.0 cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
| redhat | desktop_workstation |
5 cpe:2.3:o:redhat:desktop_workstation:5:*:*:*:*:*:*:* |
| redhat | enterprise_linux |
5.0 cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop |
5.0 6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_hpc_node |
6.0 cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server |
6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
6.2 cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_eus |
6.2.z cpe:2.3:o:redhat:enterprise_linux_server_eus:6.2.z:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation |
6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* |
Original advisory text
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof co...
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
References
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0678.html Third Party Advisory
- http://secunia.com/advisories/49273
- http://www.debian.org/security/2012/dsa-2418 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 Broken Link
- http://www.postgresql.org/about/news/1377/ Vendor Advisory
- http://www.postgresql.org/docs/8.4/static/release-8-4-11.html Release Notes Vendor Advisory
- http://www.postgresql.org/docs/9.0/static/release-9-0-7.html Release Notes Vendor Advisory
- http://www.postgresql.org/docs/9.1/static/release-9-1-3.html Release Notes Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
4.3
Medium
Type
CWE-20Improper Input Validation
CWE-295Improper Certificate Validation
Timeline
Published18 Jul 2012
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-0867 · NVD
Track software like this
Free during beta