CVE-2017-7485: Medium severity PostgreSQL postgresql vulnerability
Documentation asserts that, given this variable, libpq will attempt SSL connections only. Instead, libpq ignores the variable and attempts a non-SSL connection after an SSL connection fails. (libpq is a prominent programming interface for PostgreSQL clients.) An attacker intercepting session startup could compel use of a non-SSL connection, then record or modify the remainder of the session. The long-preferred PGSSLMODE environment variable does not have this problem and provides strictly more control.
Affected versions: 9.3 - 9.6
Other sources
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7485?
The severity of CVE-2017-7485 is considered medium due to the potential for a Man-in-the-Middle attack.
How do I fix CVE-2017-7485?
To fix CVE-2017-7485, update PostgreSQL to version 9.3.17, 9.4.12, 9.5.7, 9.6.3 or later.
What versions of PostgreSQL are affected by CVE-2017-7485?
PostgreSQL versions 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 are affected by CVE-2017-7485.
Is the PGREQUIRESSL environment variable related to CVE-2017-7485?
Yes, CVE-2017-7485 involves the PGREQUIRESSL environment variable not enforcing an SSL/TLS connection.
What attack vectors could exploit CVE-2017-7485?
An active Man-in-the-Middle attacker could exploit CVE-2017-7485 by stripping SSL/TLS connections.