CVE-2012-0867
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.3 Medium
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.0%
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
Affected configurations
References
lists.opensuse.org/opensuse-updates/2012-09/msg00060.html
rhn.redhat.com/errata/RHSA-2012-0678.html
secunia.com/advisories/49273
www.debian.org/security/2012/dsa-2418
www.mandriva.com/security/advisories?name=MDVSA-2012:026
www.postgresql.org/about/news/1377/
www.postgresql.org/docs/8.4/static/release-8-4-11.html
www.postgresql.org/docs/9.0/static/release-9-0-7.html
www.postgresql.org/docs/9.1/static/release-9-1-3.html
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.3 Medium
AI Score
Confidence
High
0.005 Low
EPSS
Percentile
76.0%