CVE-2012-0867

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

Published: Jul 19, 2012
Updated: Apr 13, 2023
CVE: CVE-2012-0867
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
opensuse_project / opensuse	12.2	12.2.x
postgresql / postgresql	8.4.8	8.4.8.x
postgresql / postgresql	8.4.4	8.4.4.x
postgresql / postgresql	8.4.1	8.4.1.x
postgresql / postgresql	8.4.9	8.4.9.x
postgresql / postgresql	8.4.3	8.4.3.x
postgresql / postgresql	8.4.10	8.4.10.x
postgresql / postgresql	8.4.6	8.4.6.x
postgresql / postgresql	8.4	8.4.x
postgresql / postgresql	8.4.5	8.4.5.x
postgresql / postgresql	8.4.7	8.4.7.x
postgresql / postgresql	8.4.2	8.4.2.x
postgresql / postgresql	9.0.6	9.0.6.x
postgresql / postgresql	9.0.4	9.0.4.x
postgresql / postgresql	9.0.1	9.0.1.x
postgresql / postgresql	9.0.3	9.0.3.x
postgresql / postgresql	9.0	9.0.x
postgresql / postgresql	9.0.2	9.0.2.x
postgresql / postgresql	9.0.5	9.0.5.x
debian / debian_linux	6.0	6.0.x
redhat / enterprise_linux_server_aus	6.2	6.2.x
redhat / enterprise_linux_server_eus	6.2.z	6.2.z.x
redhat / enterprise_linux_hpc_node	6.0	6.0.x
redhat / enterprise_linux_desktop	6.0	6.0.x
redhat / enterprise_linux_server	6.0	6.0.x
redhat / enterprise_linux	5.0	5.0.x
redhat / enterprise_linux_workstation	6.0	6.0.x
redhat / enterprise_linux_desktop	5.0	5.0.x
redhat / desktop_workstation	5	5.x
postgresql / postgresql	9.1	9.1.x
postgresql / postgresql	9.1.2	9.1.2.x
postgresql / postgresql	9.1.1	9.1.1.x

Vulnerability Database

289,599

CVE-2012-0867