Input validation error in PostgreSQL - CVE-2012-0867
Published: December 7, 2016 / Updated: June 23, 2025
Vulnerability identifier: #VU111765
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-0867
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to corrupt data.
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
Affected software
PostgreSQL
Gentoo Linux
dev-db/postgresql-server
Gentoo Linux
dev-db/postgresql-server
How to mitigate CVE-2012-0867
Install update from vendor's website.
PostgreSQL - addressed in versions 8.4.11, 9.0.7, 9.1.3
dev-db/postgresql-server - update to 9.1.5
dev-db/postgresql-server - update to 9.1.5
External References
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html
- http://rhn.redhat.com/errata/RHSA-2012-0678.html
- http://secunia.com/advisories/49273
- http://www.debian.org/security/2012/dsa-2418
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:026
- http://www.postgresql.org/about/news/1377/
- http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
- http://www.postgresql.org/docs/9.0/static/release-9-0-7.html
- http://www.postgresql.org/docs/9.1/static/release-9-1-3.html