{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-12-14T00:00:00", "descriptions": [{"lang": "en", "value": "PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "61038", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/61038"}, {"name": "HPSBMU02781", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=134124585221119&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.postgresql.org/docs/current/static/release-8-2-15.html"}, {"name": "FEDORA-2009-13363", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01035.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.postgresql.org/support/security.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.postgresql.org/docs/current/static/release-8-4-2.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.postgresql.org/docs/current/static/release-8-0-23.html"}, {"name": "20100307 rPSA-2010-0012-1 postgresql postgresql-contrib postgresql-server", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/509917/100/0/threaded"}, {"name": "SUSE-SR:2010:001", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.postgresql.org/docs/current/static/release-8-3-9.html"}, {"name": "FEDORA-2009-13381", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01056.html"}, {"name": "1023325", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1023325"}, {"name": "MDVSA-2009:333", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:333"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.postgresql.org/docs/current/static/release-7-4-27.html"}, {"name": "37334", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/37334"}, {"name": "ADV-2009-3519", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/3519"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.postgresql.org/docs/current/static/release-8-1-19.html"}, {"name": "37663", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/37663"}, {"name": "SSRT100617", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=134124585221119&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T06:45:51.064Z"}, "title": "CVE Program Container", "references": [{"name": "61038", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/61038"}, {"name": "HPSBMU02781", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=134124585221119&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.postgresql.org/docs/current/static/release-8-2-15.html"}, {"name": "FEDORA-2009-13363", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01035.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.postgresql.org/support/security.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.postgresql.org/docs/current/static/release-8-4-2.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.postgresql.org/docs/current/static/release-8-0-23.html"}, {"name": "20100307 rPSA-2010-0012-1 postgresql postgresql-contrib postgresql-server", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/509917/100/0/threaded"}, {"name": "SUSE-SR:2010:001", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.postgresql.org/docs/current/static/release-8-3-9.html"}, {"name": "FEDORA-2009-13381", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01056.html"}, {"name": "1023325", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1023325"}, {"name": "MDVSA-2009:333", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:333"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.postgresql.org/docs/current/static/release-7-4-27.html"}, {"name": "37334", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/37334"}, {"name": "ADV-2009-3519", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/3519"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.postgresql.org/docs/current/static/release-8-1-19.html"}, {"name": "37663", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/37663"}, {"name": "SSRT100617", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=134124585221119&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2009-4034", "datePublished": "2009-12-15T18:00:00", "dateReserved": "2009-11-20T00:00:00", "dateUpdated": "2024-08-07T06:45:51.064Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "0C8DDD98-9A2D-402D-9172-F3C4C4C97FEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "20C8302B-631A-4DF7-839B-C6F3CC39E000", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "FB318EB9-1B49-452A-92CF-89D9BA990AB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "5913A53B-7B72-4CBD-ADAE-318333EB8B7B", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "815E58C0-327D-4F14-B496-05FC8179627E", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*", "matchCriteriaId": "3EF2D056-5120-4F98-8343-4EC31F962CFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*", "matchCriteriaId": "516E0E86-3D8A-43F9-9DD5-865F5C889FC4", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*", "matchCriteriaId": "5A7A9D3C-4BB6-4974-BF96-6E6728196F4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*", "matchCriteriaId": "486EDE1B-37E0-4DDF-BFC9-C8C8945D5E2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*", "matchCriteriaId": "A7FC7F18-B227-4C46-9A33-FB34DDE456CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*", "matchCriteriaId": "BCDB903F-0C89-4E65-857E-553CF9C192E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*", "matchCriteriaId": "F6BF8B1E-68F7-4F27-AD1F-FA02B256BDAA", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*", "matchCriteriaId": "CD0DEB63-CA70-44C1-9491-E0790D1A8E21", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*", "matchCriteriaId": "DA8E73E5-BA41-4FA2-8457-803A97FB00C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.15:*:*:*:*:*:*:*", "matchCriteriaId": "4C9B64CA-778F-405D-A441-34599246A3F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*", "matchCriteriaId": "4975D8ED-7DCB-430F-98E1-DB165D6DA7E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*", "matchCriteriaId": "CCBF8CDE-5E75-4DF8-AE1A-B7377953917A", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.18:*:*:*:*:*:*:*", "matchCriteriaId": "8AC4A04B-738C-4018-BB2F-FBEC8746200C", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.19:*:*:*:*:*:*:*", "matchCriteriaId": "36A2824A-A43F-436B-B9DA-B7E283A00426", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.20:*:*:*:*:*:*:*", "matchCriteriaId": "DBBAF0F1-7A70-41DC-89A7-2EF9851E4FC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.21:*:*:*:*:*:*:*", "matchCriteriaId": "4A12EC07-1938-41BF-BCFC-C269668F1EBE", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.22:*:*:*:*:*:*:*", "matchCriteriaId": "14D7CE0D-510C-46BB-8896-42DD84F57017", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.23:*:*:*:*:*:*:*", "matchCriteriaId": "1AA5858F-7DFF-460D-B862-83DD636D0A36", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.24:*:*:*:*:*:*:*", "matchCriteriaId": "4394564D-131D-41C8-AE3A-BFF44779F27B", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.25:*:*:*:*:*:*:*", "matchCriteriaId": "2CCC06DB-1C93-4DE5-AEDC-03E532DA89F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:7.4.26:*:*:*:*:*:*:*", "matchCriteriaId": "62133846-C0C8-473A-A842-2A8AF50C2FD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B45F3BF0-9EB6-4A06-B6F7-DE95DD13EFBF", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "91D1232E-4D0A-4BDC-99F6-25AEE014E9AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "105E9F52-D17E-4A0B-9C46-FD32A930B1E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "0DE2055D-AAA4-4A6A-918F-349A9749AF09", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "C12409B2-161B-4F78-B7AD-3CF69DDCC574", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "DD2F1DA4-6625-469D-988B-5457B68851A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "870F4348-6001-4C2F-A547-61964074E7C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "E2E26D52-D95A-4547-BE6E-4F142F54A624", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "4AAB2D1D-BE61-4D7C-B305-58B4F4126620", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "2A5F8D8B-34C5-4EBC-BB20-4D11191238B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "E260F1F9-0068-4289-A8E8-C30220C2E1F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*", "matchCriteriaId": "EEE16023-9A5E-46D5-B597-E6885C224786", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.12:*:*:*:*:*:*:*", "matchCriteriaId": "84D64D74-9645-4CB7-B710-4FC26FB65B37", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*", "matchCriteriaId": "BCF2794E-6B48-496B-B6CA-CDC7FC2160CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "8EB12063-F487-4067-A7A5-4482E19D8D14", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "51AE5B72-DDC5-4207-B467-A9583F3AC781", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "99398182-C98C-4B16-9DBA-B1980BDFFA54", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "E6FEC1DE-A2A5-4945-95B8-75FDC9ED3B63", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.18:*:*:*:*:*:*:*", "matchCriteriaId": "264AB44D-D014-4734-B538-09E5834EC30B", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.19:*:*:*:*:*:*:*", "matchCriteriaId": "8D5DD1E6-E190-4D75-9D27-5EFB2544B158", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.20:*:*:*:*:*:*:*", "matchCriteriaId": "3CD7F8CA-09B3-4038-B8B0-2D62A77F2478", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.21:*:*:*:*:*:*:*", "matchCriteriaId": "64815C3D-1A1A-4525-9BCD-D89BAEACC950", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.0.22:*:*:*:*:*:*:*", "matchCriteriaId": "7B61AFB3-818D-4A82-8C80-9CA9A1DCC090", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "C0B9704E-4BA9-4389-83AB-62BC65F81D9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "FEEC35A2-B17C-46EC-8697-9E03568339BC", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "00562C18-DD81-4B09-AF93-739AF8757A12", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "6B52D093-7867-4FE8-B055-D8190103A1E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "DF1A06EE-26BD-4CDA-AEB9-01124FC37E37", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "FF855730-C61C-4FDC-96CB-57775A903421", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "D93296E1-AEA2-443E-B9AA-D70535DDD093", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "992C3EC0-4C12-4FB0-8844-9EFB91DA95E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "8E3EBF1D-D5BD-4A22-B76A-2BAB21534E70", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*", "matchCriteriaId": "02DC4E8A-A728-4734-B67A-C58C37DA90C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.10:*:*:*:*:*:*:*", "matchCriteriaId": "D59B0E32-9E71-4E41-BBAF-7A20008E43E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.11:*:*:*:*:*:*:*", "matchCriteriaId": "CA6511DE-AF52-4953-8394-37D24A732538", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.12:*:*:*:*:*:*:*", "matchCriteriaId": "51B93DC5-F632-47A5-9C58-52429B034D1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.13:*:*:*:*:*:*:*", "matchCriteriaId": "D011C676-47D3-4D78-9C58-749AF6C7DBDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.14:*:*:*:*:*:*:*", "matchCriteriaId": "DFD5BE40-CF55-4C0E-BD89-5CC7DF41F6BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.15:*:*:*:*:*:*:*", "matchCriteriaId": "7C1EE1C3-4472-4CE2-AB60-9535C1C4AF8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.16:*:*:*:*:*:*:*", "matchCriteriaId": "3B903334-2F67-4725-8277-6913E03BEFC3", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.17:*:*:*:*:*:*:*", "matchCriteriaId": "2F6E9049-B347-4940-B523-DBB96DBFE731", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.1.18:*:*:*:*:*:*:*", "matchCriteriaId": "6F1AD77C-BD28-43C9-B2CA-F60C1AD9D200", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*", "matchCriteriaId": "7213327F-6909-43A7-952E-11600C28D4E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "10EF0EA6-C8B6-40A7-A3AE-8639CA94D5C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "D9F645F3-9767-4FD8-94EB-1096DF24E6C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "C342A823-EF6F-4557-9F9E-D8893EA4C2BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "B85A443F-0802-412F-9AEE-3525311C93D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "06253BA8-7F1E-4C79-9B2E-197307A627F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "2A213AB8-A5FE-4062-B895-2FC4B19F60A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "9A3F083E-59A8-41B1-826F-2CA39BD425C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "DE49E2D5-8EAC-49C7-B704-E626FBE7EC35", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "A5059B2F-B588-463E-8E96-BC9DA129C12E", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "C919AF97-9713-44F8-B742-89C438DB0B48", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.11:*:*:*:*:*:*:*", "matchCriteriaId": "400BBC62-5D03-465B-A864-9CD479B963F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.12:*:*:*:*:*:*:*", "matchCriteriaId": "BC8C96F7-7F85-4E47-A05F-15E3C70AF583", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.13:*:*:*:*:*:*:*", "matchCriteriaId": "6C236CF1-72C0-4C3D-AE04-B67E3F18EEC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.2.14:*:*:*:*:*:*:*", "matchCriteriaId": "ECC98D47-8B3C-4DE6-8C45-F5B92266027F", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "05AD5D33-86F4-4BFF-BA84-02AA1347BEEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "02FDCF30-D0F7-48AA-9633-9CC060495F47", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "788975F6-B3F1-4C21-B963-6BA59F14B71C", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "E6713D96-338B-4467-9F05-3153997F62E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "01EB1A77-92AD-47FB-8290-D05C9B6C19C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "74857259-30C7-422D-A24D-BE1E33F09466", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "CD80066B-787E-496B-88FD-F0AE291468C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "88C9F0AB-A125-4DCD-A02B-E04D4D95FB5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "5C991F71-1E27-47A6-97DC-424FC3EF6011", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."}, {"lang": "es", "value": "PostgreSQL v7.4.x anteriores a v7.4.27, v8.0.x anteriores a v8.0.23, v8.1.x anteriores a v8.1.19, v8.2.x anteriores a v8.2.15, v8.3.x anteriores a v8.3.9, y v8.4.x anteriores a v8.4.2 no maneja adecuadamente un caracter '/0' en el nombre de dominio en el campo \"subject\" del Nombre Com\u00fan (CN) de un certificado X.509, lo que permite (1) a atacantes man-in-the-middle falsificar a conveniencia los servidores PostgreSQL basados en SSL a trav\u00e9s de un certificado de servidor manipulado obtenido a trav\u00e9s de una autoridad certificadora legitima, y (2)permite a atacantes remotos evitar las restricciones cliente-hostname a trav\u00e9s de un certificado manipulado obtenido a trav\u00e9s de una autoridad certificadora legitima, un asunto relacionado con CVE-2009-2408."}], "id": "CVE-2009-4034", "lastModified": "2018-10-10T19:48:12.817", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-12-15T18:30:01.420", "references": [{"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"}, {"source": "secalert@redhat.com", "url": "http://marc.info/?l=bugtraq&m=134124585221119&w=2"}, {"source": "secalert@redhat.com", "url": "http://osvdb.org/61038"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/37663"}, {"source": "secalert@redhat.com", "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012"}, {"source": "secalert@redhat.com", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:333"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.postgresql.org/docs/current/static/release-7-4-27.html"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.postgresql.org/docs/current/static/release-8-0-23.html"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.postgresql.org/docs/current/static/release-8-1-19.html"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.postgresql.org/docs/current/static/release-8-2-15.html"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.postgresql.org/docs/current/static/release-8-3-9.html"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.postgresql.org/docs/current/static/release-8-4-2.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://www.postgresql.org/support/security.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/archive/1/509917/100/0/threaded"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/37334"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id?1023325"}, {"source": "secalert@redhat.com", "url": "http://www.vupen.com/english/advisories/2009/3519"}, {"source": "secalert@redhat.com", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01035.html"}, {"source": "secalert@redhat.com", "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01056.html"}], "sourceIdentifier": "secalert@redhat.com", "vendorComments": [{"comment": "This issue is only security-relevant in PostgreSQL versions 8.4 and later as previous versions did not compare the connection host name with the certificate CommonName at all. Client certificate authentication was introduced in version 8.4. Red Hat Enterprise Linux 5 and earlier provided PostgreSQL versions 8.1.x and earlier, and are thus not affected by this issue.\n", "lastModified": "2010-01-07T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "postgresql: incorrect verification of SSL certificates with NUL in name", "id": "547662", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547662"}, "csaw": false, "cvss": {"cvss_base_score": "3.6", "cvss_scoring_vector": "AV:N/AC:H/Au:S/C:P/I:P/A:N", "status": "draft"}, "details": ["PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."], "name": "CVE-2009-4034", "public_date": "2009-12-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-4034\nhttps://nvd.nist.gov/vuln/detail/CVE-2009-4034"], "statement": "This issue is only security-relevant in PostgreSQL versions 8.4 and later as previous versions did not compare the connection host name with the certificate CommonName at all. Client certificate authentication was introduced in version 8.4. Red Hat Enterprise Linux 5 and earlier provided PostgreSQL versions 8.1.x and earlier, and are thus not affected by this issue.", "threat_severity": "Low"}