CVE-2009-4034
Last modified
CVE-2009-4034 is a vulnerability of currently unknown severity. PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.. EPSS estimates a 2.13% chance of exploitation in the next 30 days.
Description
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | 7.4.1 |
| Postgresql | Postgresql | 7.4.2 |
| Postgresql | Postgresql | 7.4.3 |
| Postgresql | Postgresql | 7.4.4 |
| Postgresql | Postgresql | 7.4.5 |
| Postgresql | Postgresql | 7.4.6 |
| Postgresql | Postgresql | 7.4.7 |
| Postgresql | Postgresql | 7.4.8 |
| Postgresql | Postgresql | 7.4.9 |
| Postgresql | Postgresql | 7.4.10 |
| Postgresql | Postgresql | 7.4.11 |
| Postgresql | Postgresql | 7.4.12 |
| Postgresql | Postgresql | 7.4.13 |
| Postgresql | Postgresql | 7.4.14 |
| Postgresql | Postgresql | 7.4.15 |
| Postgresql | Postgresql | 7.4.16 |
| Postgresql | Postgresql | 7.4.17 |
| Postgresql | Postgresql | 7.4.18 |
| Postgresql | Postgresql | 7.4.19 |
| Postgresql | Postgresql | 7.4.20 |
| Postgresql | Postgresql | 7.4.21 |
| Postgresql | Postgresql | 7.4.22 |
| Postgresql | Postgresql | 7.4.23 |
| Postgresql | Postgresql | 7.4.24 |
| Postgresql | Postgresql | 7.4.25 |
| Postgresql | Postgresql | 7.4.26 |
| Postgresql | Postgresql | 8.0.0 |
| Postgresql | Postgresql | 8.0.1 |
| Postgresql | Postgresql | 8.0.2 |
| Postgresql | Postgresql | 8.0.3 |
| Postgresql | Postgresql | 8.0.4 |
| Postgresql | Postgresql | 8.0.5 |
| Postgresql | Postgresql | 8.0.6 |
| Postgresql | Postgresql | 8.0.7 |
| Postgresql | Postgresql | 8.0.8 |
| Postgresql | Postgresql | 8.0.9 |
| Postgresql | Postgresql | 8.0.10 |
| Postgresql | Postgresql | 8.0.11 |
| Postgresql | Postgresql | 8.0.12 |
| Postgresql | Postgresql | 8.0.13 |
| Postgresql | Postgresql | 8.0.14 |
| Postgresql | Postgresql | 8.0.15 |
| Postgresql | Postgresql | 8.0.16 |
| Postgresql | Postgresql | 8.0.17 |
| Postgresql | Postgresql | 8.0.18 |
| Postgresql | Postgresql | 8.0.19 |
| Postgresql | Postgresql | 8.0.20 |
| Postgresql | Postgresql | 8.0.21 |
| Postgresql | Postgresql | 8.0.22 |
| Postgresql | Postgresql | 8.1.0 |
Showing 50 of 92 affected configurations. See NVD for the full list.
References
- http://www.postgresql.org/docs/current/static/release-7-4-27.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-0-23.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-1-19.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-2-15.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-3-9.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-4-2.htmlPatch, Vendor Advisory
- http://www.postgresql.org/support/security.htmlVendor Advisory
- http://www.postgresql.org/docs/current/static/release-7-4-27.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-0-23.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-1-19.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-2-15.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-3-9.htmlPatch, Vendor Advisory
- http://www.postgresql.org/docs/current/static/release-8-4-2.htmlPatch, Vendor Advisory
- http://www.postgresql.org/support/security.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-4034?
How severe is CVE-2009-4034?
How do I fix CVE-2009-4034?
Are you affected by CVE-2009-4034?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST