Man-in-the-middle attack in PostgreSQL - CVE-2017-7485

Vulnerability identifier: #VU6893

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7485

CWE-ID: CWE-300

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to conduct a man-in-the-middle attack.

The weakness exists in the PGREQUIRESSL environment due to no enforcement of a SSL/TLS connection to a PostgreSQL server. A remote attacker can launch a man-in-the-middle attack to strip the SSL/TLS protection from a connection between a client and a server and modify the communicated data.

Successful exploitation of the vulnerability results in unauthorized access to sensitive information.

PostgreSQL
Arch Linux
Gentoo Linux
Debian Linux
Amazon Linux AMI
Fedora
Red Hat Satellite
postgresql (Alpine package)
postgresql
mingw-postgresql

Update to versions 9.3.17, 9.4.12, 9.5.7, 9.6.3.

postgresql (Alpine package) - update to 9.4.12-r0
postgresql - update to 9.6.3-1.fc26
mingw-postgresql - update to 9.6.3-1.fc26

• https://www.postgresql.org/about/news/1746/

• Arch Linux update for postgresql
• Arch Linux update for postgresql-libs
• Red Hat update for PostgreSQL
• Gentoo update for PostgreSQL
• Debian update for postgresql-9.4
• Amazon Linux AMI update for postgresql93, postgresql94, postgresql95
• Red Hat update for rh-postgresql95-postgresql
• Man-in-the-middle attack in postgresql (Alpine package)
• Fedora 26 update for postgresql
• Fedora 26 update for mingw-postgresql