New Search

Vulnerability in PostgreSQL 7.4.x before 7.4.27 8.0.x before 8.0.23 8.1.x before 8.1.19 8.2.x before 8.2.15 8.3.x before 8.3.9 and 8.4.x before 8.4.2 (CVE-2009-4034)

oval:org.cisecurity:def:8232

PostgreSQL 7.4.x before 7.4.27 8.0.x before 8.0.23 8.1.x before 8.1.19 8.2.x before 8.2.15 8.3.x before 8.3.9 and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority a related issue to CVE-2009-2408.

Family:
windows
Status:
ACCEPTED
Platform(s):
  • Microsoft Windows Server 2016
  • Microsoft Windows 10
  • Microsoft Windows 8.1
  • Microsoft Windows XP
  • Microsoft Windows Server 2003
  • Microsoft Windows Server 2012
  • Microsoft Windows Server 2008 R2
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows 8
  • Microsoft Windows Server 2008
  • Microsoft Windows Vista
  • Microsoft Windows 7
Class:
vulnerability
Reference(s):
  • CVE-2009-4034
Product(s):
  • PostgreSQL