NVD

Id
51187  
Name
CVE-2009-4034  
Description
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a "" character in a domain name in the subject"s Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-12-15  
Modified Date
2016-08-22  
Seq
2009-4034  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
259692 51187 CVE-2009-4034 SUSE-SR:2010:001  View
259693 51187 CVE-2009-4034 SSRT100617  View
259694 51187 CVE-2009-4034 http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012  View
259695 51187 CVE-2009-4034 MDVSA-2009:333  View
259696 51187 CVE-2009-4034 http://www.postgresql.org/docs/current/static/release-7-4-27.html  View
259697 51187 CVE-2009-4034 http://www.postgresql.org/docs/current/static/release-8-0-23.html  View
259698 51187 CVE-2009-4034 http://www.postgresql.org/docs/current/static/release-8-1-19.html  View
259699 51187 CVE-2009-4034 http://www.postgresql.org/docs/current/static/release-8-2-15.html  View
259700 51187 CVE-2009-4034 http://www.postgresql.org/docs/current/static/release-8-3-9.html  View
259701 51187 CVE-2009-4034 http://www.postgresql.org/docs/current/static/release-8-4-2.html  View
259702 51187 CVE-2009-4034 http://www.postgresql.org/support/security.html  View
259703 51187 CVE-2009-4034 20100307 rPSA-2010-0012-1 postgresql postgresql-contrib postgresql-server  View
259704 51187 CVE-2009-4034 37334  View
259705 51187 CVE-2009-4034 1023325  View
259706 51187 CVE-2009-4034 ADV-2009-3519  View
259707 51187 CVE-2009-4034 FEDORA-2009-13363  View
259708 51187 CVE-2009-4034 FEDORA-2009-13381  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41442 JVNDB-2009-002449 PostgreSQL における X.509 証明書の処理に関する任意の SSL-based PostgreSQL サーバになりすまされる脆弱性 PostgreSQL には、X.509 証明書の Common Name (CN) フィールド内のドメイン名にある "" を適切に処理しないため、任意の SSL-based PostgreSQL サーバになりすまされる脆弱性が存在します。 CVE-2009-4034 41465 CVE-2009-4034 51187 5.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002449.html 2009-12-15 2010-01-26 View