CVE-2017-7485
Description
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
Risk Information
Base Score
5.9
MODERATE
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.71
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Update PostgressSQL to 9.3.17 | Windows |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.6.3 | Windows |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.5.7 | Windows |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.4.12 | Windows |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.3.17 | Windows |
| postgresql-9.4 security update(DSA-3851-1) postgresql-9.4_9.4.12-0+deb8u1_i386.deb | Linux |
| Update PostgressSQL to 9.3.17 (For Linux) | Linux |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.6.3 (For Linux) | Linux |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.5.7 (For Linux) | Linux |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.4.12 (For Linux) | Linux |
| Vulnerabilities CVE-2017-7486,CVE-2017-7485,CVE-2017-7484 are fixed in PostgreSQL 9.3.17 (For Linux) | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234