CVSS: 4.3EPSS: 0%CPEs: 32EXPL: 0CVE-2012-0867 – postgresql: MITM due improper x509_v3 CN validation during certificate verification
https://notcve.org/view.php?id=CVE-2012-0867
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters. PostgreSQL v8.4.x antes de v8.4.11, v9.0.x antes de v9.0.7, y v9.1.x antes de v9.1.3 trunca el nombre común a sólo 32 caracteres en la verificación de los certificados SSL, lo que permite a atacantes remotos falsificar conexiones cuando el nombre de host es exactamente de 32 caracteres. • http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html http://rhn.redhat.com/errata/RHSA-2012-0678.html http://secunia.com/advisories/49273 http://www.debian.org/security/2012/dsa-2418 http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 http://www.postgresql.org/about/news/1377 http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html http://www.postgresql.org/docs/9.1&#x • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •
CVSS: 6.8EPSS: 0%CPEs: 39EXPL: 0CVE-2012-0868 – postgresql: SQL injection due unsanitized newline characters in object names
https://notcve.org/view.php?id=CVE-2012-0868
CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored. Vulnerabilidad de inyección CRLF en pg_dump en PostgreSQL v8.3.x antes de v8.3.18, v8.4.x antes de v8.4.11, v9.0.x antes de v9.0.7 y v9.1.x antes de v9.1.3 permite a atacantes remotos asistida por el usuario ejecutar comandos SQL a través de un archivo modificado que contiene los nombres de objeto con saltos de línea que se insertan en una secuencia de comandos SQL que se utiliza cuando la base de datos se restaura. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html http://rhn.redhat.com/errata/RHSA-2012-0677.html http://rhn.redhat.com/errata/RHSA-2012-0678.html http://secunia.com/advisories/49272 http://secunia.com/advisories/49273 http://www.debian.org/security/2012/dsa-2418 http://www.mandriva.com/security/advisories?name=MDVSA-2012:026 http://www.mandriva.com/security/advisories?name=MDVSA-2012:027 http:/ • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2011-2483 – crypt_blowfish: 8-bit character mishandling allows different password pairs to produce the same hash
https://notcve.org/view.php?id=CVE-2011-2483
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash. crypt_blowfish en versiones anteriores a 1.1, como se utiliza en PHP en versiones anteriores a 5.3.7 en ciertas plataformas, PostgreSQL en versiones anteriores a 8.4.9 y otros productos, no maneja adecuadamente caracteres de 8-bit, lo que hace más fácil a atacantes dependientes de contexto determinar una contraseña en texto plano aprovechando el conocimiento del hash de una contraseña. • http://freshmeat.net/projects/crypt_blowfish http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00015.html http://php.net/security/crypt_blowfish http://support.apple.com/kb/HT5130 http://www.debian.org/security/2011/dsa-2340 http://www.debian.org/security/2012/dsa-2399 http://www.mandriva.com/security/advisories?name=MDVSA-2011:165&# • CWE-310: Cryptographic Issues •