CVE-2009-4034

Priority
Description
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19,
8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not
properly handle a '\0' character in a domain name in the subject's Common
Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle
attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted
server certificate issued by a legitimate Certification Authority, and (2)
allows remote attackers to bypass intended client-hostname restrictions via
a crafted client certificate issued by a legitimate Certification
Authority, a related issue to CVE-2009-2408.
Package
Upstream:needs-triage
Package
Upstream:needs-triage
Package
Upstream:needs-triage
Package
Upstream:needs-triage
Package
Upstream:needs-triage
Package
Upstream:needs-triage
More Information

Updated: 2019-03-19 11:51:26 UTC (commit 15472795df7e9de45b82f2d36b8b419b939f97b2)