CVE-2012-0867

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html	Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0678.html	Third Party Advisory
http://secunia.com/advisories/49273
http://www.debian.org/security/2012/dsa-2418	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:026	Broken Link
http://www.postgresql.org/about/news/1377/	Vendor Advisory
http://www.postgresql.org/docs/8.4/static/release-8-4-11.html	Release Notes Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-7.html	Release Notes Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-3.html	Release Notes Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html	Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0678.html	Third Party Advisory
http://secunia.com/advisories/49273
http://www.debian.org/security/2012/dsa-2418	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:026	Broken Link
http://www.postgresql.org/about/news/1377/	Vendor Advisory
http://www.postgresql.org/docs/8.4/static/release-8-4-11.html	Release Notes Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-7.html	Release Notes Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-3.html	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:opensuse_project:opensuse:12.2:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:postgresql:postgresql:8.4:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.1:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.2:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.3:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.4:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.5:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.6:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.7:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.8:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.9:::::::*
	cpe:2.3:a:postgresql:postgresql:8.4.10:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:postgresql:postgresql:9.0:::::::*
	cpe:2.3:a:postgresql:postgresql:9.0.1:::::::*
	cpe:2.3:a:postgresql:postgresql:9.0.2:::::::*
	cpe:2.3:a:postgresql:postgresql:9.0.3:::::::*
	cpe:2.3:a:postgresql:postgresql:9.0.4:::::::*
	cpe:2.3:a:postgresql:postgresql:9.0.5:::::::*
	cpe:2.3:a:postgresql:postgresql:9.0.6:::::::*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR	cpe:2.3:o:redhat:desktop_workstation:5:::::::*
	cpe:2.3:o:redhat:enterprise_linux:5.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_eus:6.2.z:::::::*
	cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*

Configuration 6 (hide)

OR	cpe:2.3:a:postgresql:postgresql:9.1:::::::*
	cpe:2.3:a:postgresql:postgresql:9.1.1:::::::*
	cpe:2.3:a:postgresql:postgresql:9.1.2:::::::*

History

21 Nov 2024, 01:35

Type	Values Removed	Values Added
References	~~() http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html - Third Party Advisory~~	() http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html - Third Party Advisory
References	~~() http://rhn.redhat.com/errata/RHSA-2012-0678.html - Third Party Advisory~~	() http://rhn.redhat.com/errata/RHSA-2012-0678.html - Third Party Advisory
References	~~() http://secunia.com/advisories/49273 -~~	() http://secunia.com/advisories/49273 -
References	~~() http://www.debian.org/security/2012/dsa-2418 - Third Party Advisory~~	() http://www.debian.org/security/2012/dsa-2418 - Third Party Advisory
References	~~() http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 - Broken Link~~	() http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 - Broken Link
References	~~() http://www.postgresql.org/about/news/1377/ - Vendor Advisory~~	() http://www.postgresql.org/about/news/1377/ - Vendor Advisory
References	~~() http://www.postgresql.org/docs/8.4/static/release-8-4-11.html - Release Notes, Vendor Advisory~~	() http://www.postgresql.org/docs/8.4/static/release-8-4-11.html - Release Notes, Vendor Advisory
References	~~() http://www.postgresql.org/docs/9.0/static/release-9-0-7.html - Release Notes, Vendor Advisory~~	() http://www.postgresql.org/docs/9.0/static/release-9-0-7.html - Release Notes, Vendor Advisory
References	~~() http://www.postgresql.org/docs/9.1/static/release-9-1-3.html - Release Notes, Vendor Advisory~~	() http://www.postgresql.org/docs/9.1/static/release-9-1-3.html - Release Notes, Vendor Advisory

Information

Published : 2012-07-18 23:55

Updated : 2024-11-21 01:35

NVD link : CVE-2012-0867

Mitre link : CVE-2012-0867

CVE.ORG link : CVE-2012-0867

JSON object : View

Products Affected

redhat

enterprise_linux_server
enterprise_linux_server_eus
enterprise_linux
enterprise_linux_desktop
desktop_workstation
enterprise_linux_hpc_node
enterprise_linux_server_aus
enterprise_linux_workstation

debian

debian_linux

opensuse_project

opensuse

postgresql

postgresql

CWE

CWE-20

Improper Input Validation

CWE-295

Improper Certificate Validation

4.3 /10