Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2012-0867

Good to know:

icon
icon

Date: July 18, 2012

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

Language: C

Severity Score

Related Resources (13)

https://nvd.nist.gov/vuln/detail/CVE-2012-0867
http://rhn.redhat.com/errata/RHSA-2012-0678.html
http://www.debian.org/security/2012/dsa-2418
http://www.postgresql.org/about/news/1377/
http://secunia.com/advisories/49273
http://www.mandriva.com/security/advisories?name=MDVSA-2012:026
http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html
https://people.canonical.com/~ubuntu-security/cve/CVE-2012-0867
http://www.postgresql.org/docs/9.0/static/release-9-0-7.html
http://www.postgresql.org/docs/9.1/static/release-9-1-3.html
http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
https://access.redhat.com/security/cve/CVE-2012-0867
https://www.mend.io/vulnerability-database/CVE-2012-0867

Severity Score

Weakness Type (CWE)

Improper Certificate Validation

CWE-295

Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version REL9_2_BETA1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us