MEDIUM🇬🇧 English

CVE-2017-7485

CVSS 5.9v3.0pub. 2017-05-12upd. 2026-05-13

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

  • PostgreSQL

    APP
    Postgresql
    9.39.3.19.3.109.3.119.3.129.3.139.3.149.3.159.3.169.3.29.3.39.3.49.3.59.3.69.3.7+ 24 więcej
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2015-0244CRITICAL9.8ten sam produkt

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1...

CVE-2015-3166CRITICAL9.8ten sam produkt

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x befor...

CVE-2019-10211CRITICAL9.8ten sam produkt

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled Ope...

CVE-2018-16850CRITICAL9.8ten sam produkt

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE...

CVE-2018-1115CRITICAL9.1ten sam produkt

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rot...