CVE-2012-0867

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

• CWE-20
• CWE-295

• http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0678.htmlThird Party Advisory
• http://secunia.com/advisories/49273
• http://www.debian.org/security/2012/dsa-2418Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:026Broken Link
• http://www.postgresql.org/about/news/1377/Vendor Advisory
• http://www.postgresql.org/docs/8.4/static/release-8-4-11.htmlRelease Notes, Vendor Advisory
• http://www.postgresql.org/docs/9.0/static/release-9-0-7.htmlRelease Notes, Vendor Advisory
• http://www.postgresql.org/docs/9.1/static/release-9-1-3.htmlRelease Notes, Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0678.htmlThird Party Advisory
• http://secunia.com/advisories/49273
• http://www.debian.org/security/2012/dsa-2418Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:026Broken Link
• http://www.postgresql.org/about/news/1377/Vendor Advisory
• http://www.postgresql.org/docs/8.4/static/release-8-4-11.htmlRelease Notes, Vendor Advisory
• http://www.postgresql.org/docs/9.0/static/release-9-0-7.htmlRelease Notes, Vendor Advisory
• http://www.postgresql.org/docs/9.1/static/release-9-1-3.htmlRelease Notes, Vendor Advisory

Published

Jul 18, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0861The vds_installer in Red Hat Enterprise Virtualization Manag…
• CVE-2012-0862builtins.c in Xinetd before 2.3.15 does not check the servic…
• CVE-2012-0863Mumble 1.2.3 and earlier uses world-readable permissions for…
• CVE-2012-0864Integer overflow in the vfprintf function in stdio-common/vf…
• CVE-2012-0865Multiple open redirect vulnerabilities in CubeCart 3.0.20 an…
• CVE-2012-0866CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x befo…
• CVE-2012-0868CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x …
• CVE-2012-0869Cross-site scripting (XSS) vulnerability in fup in Frams' Fa…
• CVE-2012-0870Heap-based buffer overflow in process.c in smbd in Samba 3.0…
• CVE-2012-0871The session_link_x11_socket function in login/logind-session…
• CVE-2012-0872Multiple cross-site scripting (XSS) vulnerabilities in OxWal…
• CVE-2012-0873Multiple cross-site scripting (XSS) vulnerabilities in Boone…