CVE-2012-0867

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-0867
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0678.html Third Party Advisory
http://secunia.com/advisories/49273
http://www.debian.org/security/2012/dsa-2418 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 Broken Link
http://www.postgresql.org/about/news/1377/ Vendor Advisory
http://www.postgresql.org/docs/8.4/static/release-8-4-11.html Release Notes Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-7.html Release Notes Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-3.html Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:opensuse_project:opensuse:12.2:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:postgresql:postgresql:8.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:postgresql:postgresql:9.0:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:redhat:desktop_workstation:5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.2.z:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*
History

No history.

Information

Published : 2012-07-18 23:55

Updated : 2024-02-04 18:16

NVD link : CVE-2012-0867

Mitre link : CVE-2012-0867

CVE.ORG link : CVE-2012-0867

JSON object : View

Products Affected

postgresql

  • postgresql

debian

  • debian_linux

redhat

  • enterprise_linux_hpc_node
  • desktop_workstation
  • enterprise_linux_server_aus
  • enterprise_linux_workstation
  • enterprise_linux_server_eus
  • enterprise_linux_server
  • enterprise_linux
  • enterprise_linux_desktop

opensuse_project

  • opensuse
CWE
CWE-20

Improper Input Validation

CWE-295

Improper Certificate Validation