Cryptographic issues in PostgreSQL - CVE-2009-4034

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU111774

Cryptographic issues in PostgreSQL - CVE-2009-4034

Published: October 10, 2018 / Updated: June 23, 2025


Vulnerability identifier: #VU111774
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-4034
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


Affected software

PostgreSQL
Gentoo Linux
dev-db/postgresql
dev-db/postgresql-server

How to mitigate CVE-2009-4034

Install update from vendor's website.

PostgreSQL - addressed in versions 7.4.27, 8.0.23, 8.1.19, 8.2.15, 8.3.9, 8.4.2
dev-db/postgresql - update to 9.0.5
dev-db/postgresql-server - update to 9.0.5

External References

Related Security Bulletins