CVE-2017-7485 - CVE House
Back to Database
Status published Medium CVE-2017-7485

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before...

Vulnerability Description

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-7485

Credits & Attribution

No credits recorded in the NVD database.

References

More from The PostgreSQL Global Development Group

View All →
CVE-2018-1058
A flaw was found in the way Postgresql allowed a...
High 8.8
CVE-2018-1053
In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before...
High 7
CVE-2018-1052
Memory disclosure vulnerability in table partitioning was found in postgresql...
Medium 6.5
CVE-2017-7486
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak...
High 7.5
CVE-2017-7484
It was found that some selectivity estimation functions in PostgreSQL...
High 7.5

Affected Vendor

The PostgreSQL Global Development Group

View all reports →

Affected Software

PostgreSQL
Vulnerable Versions:
9.3 - 9.6

Timeline

Official Publish: May 12th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-390

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.