CVE-2012-0867: Input Validation
First published: Wed Jul 18 2012(Updated: )
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Opensuse Project Opensuse | =12.2 | |
| PostgreSQL PostgreSQL | =8.4 | |
| PostgreSQL PostgreSQL | =8.4.1 | |
| PostgreSQL PostgreSQL | =8.4.2 | |
| PostgreSQL PostgreSQL | =8.4.3 | |
| PostgreSQL PostgreSQL | =8.4.4 | |
| PostgreSQL PostgreSQL | =8.4.5 | |
| PostgreSQL PostgreSQL | =8.4.6 | |
| PostgreSQL PostgreSQL | =8.4.7 | |
| PostgreSQL PostgreSQL | =8.4.8 | |
| PostgreSQL PostgreSQL | =8.4.9 | |
| PostgreSQL PostgreSQL | =8.4.10 | |
| PostgreSQL PostgreSQL | =9.0 | |
| PostgreSQL PostgreSQL | =9.0.1 | |
| PostgreSQL PostgreSQL | =9.0.2 | |
| PostgreSQL PostgreSQL | =9.0.3 | |
| PostgreSQL PostgreSQL | =9.0.4 | |
| PostgreSQL PostgreSQL | =9.0.5 | |
| PostgreSQL PostgreSQL | =9.0.6 | |
| Debian Debian Linux | =6.0 | |
| Redhat Desktop Workstation | =5 | |
| Redhat Enterprise Linux | =5.0 | |
| Redhat Enterprise Linux Desktop | =5.0 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Hpc Node | =6.0 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server Aus | =6.2 | |
| Redhat Enterprise Linux Server Eus | =6.2.z | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| PostgreSQL PostgreSQL | =9.1 | |
| PostgreSQL PostgreSQL | =9.1.1 | |
| PostgreSQL PostgreSQL | =9.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html
- http://rhn.redhat.com/errata/RHSA-2012-0678.html
- http://secunia.com/advisories/49273
- http://www.debian.org/security/2012/dsa-2418
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:026
- http://www.postgresql.org/about/news/1377/
- http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
- http://www.postgresql.org/docs/9.0/static/release-9-0-7.html
- http://www.postgresql.org/docs/9.1/static/release-9-1-3.html
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/opensuse project
- canonical/opensuse project opensuse
- version/opensuse project opensuse/12.2
- vendor/postgresql
- canonical/postgresql postgresql
- version/postgresql postgresql/8.4
- version/postgresql postgresql/8.4.1
- version/postgresql postgresql/8.4.2
- version/postgresql postgresql/8.4.3
- version/postgresql postgresql/8.4.4
- version/postgresql postgresql/8.4.5
- version/postgresql postgresql/8.4.6
- version/postgresql postgresql/8.4.7
- version/postgresql postgresql/8.4.8
- version/postgresql postgresql/8.4.9
- version/postgresql postgresql/8.4.10
- version/postgresql postgresql/9.0
- version/postgresql postgresql/9.0.1
- version/postgresql postgresql/9.0.2
- version/postgresql postgresql/9.0.3
- version/postgresql postgresql/9.0.4
- version/postgresql postgresql/9.0.5
- version/postgresql postgresql/9.0.6
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/6.0
- vendor/redhat
- canonical/redhat desktop workstation
- version/redhat desktop workstation/5
- canonical/redhat enterprise linux
- version/redhat enterprise linux/5.0
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/5.0
- version/redhat enterprise linux desktop/6.0
- canonical/redhat enterprise linux hpc node
- version/redhat enterprise linux hpc node/6.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/6.2
- canonical/redhat enterprise linux server eus
- version/redhat enterprise linux server eus/6.2.z
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- version/postgresql postgresql/9.1
- version/postgresql postgresql/9.1.1
- version/postgresql postgresql/9.1.2