Description

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

Remediation

References

CVE-2012-0867

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-29907)

WordPress Plugin InfiniteWP Client Unspecified Vulnerability (1.3.14)

WordPress Plugin HUSKY-Products Filter Professional for WooCommerce Multiple Vulnerabilities (1.1.4.2)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3832)

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2021-21027)

Severity

Medium

Classification

CVE-2012-0867 CWE-295

Tags

Missing Update Known Vulnerabilities