CVE-2012-0867

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20 CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0678.htmlThird Party Advisory
http://secunia.com/advisories/49273
http://www.debian.org/security/2012/dsa-2418Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:026Broken Link
http://www.postgresql.org/about/news/1377/Vendor Advisory
http://www.postgresql.org/docs/8.4/static/release-8-4-11.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-7.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-3.htmlRelease Notes, Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0678.htmlThird Party Advisory
http://secunia.com/advisories/49273
http://www.debian.org/security/2012/dsa-2418Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2012:026Broken Link
http://www.postgresql.org/about/news/1377/Vendor Advisory
http://www.postgresql.org/docs/8.4/static/release-8-4-11.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.0/static/release-9-0-7.htmlRelease Notes, Vendor Advisory
http://www.postgresql.org/docs/9.1/static/release-9-1-3.htmlRelease Notes, Vendor Advisory

Timeline

Published: Jul 18, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-08686.8CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 a CVE-2012-08694.3Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inje CVE-2012-08707.9Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2 CVE-2012-08716.3The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to CVE-2012-08724.3Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTM CVE-2012-08734.3Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or CVE-2012-08746.8The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Pl CVE-2012-08755.4SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information fro CVE-2012-08764.3The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictabl CVE-2012-08777.5PyXML: Hash table collisions CPU usage Denial of Service CVE-2012-08785.1Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attac CVE-2012-08795.5The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local