Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2009-4034

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PostgreSQL 是一个自由的对象-关系数据库服务器(数据库管理系统)。 PostgreSQL不能正确处理一个X.509证书的主题Common Name (CN)字段中的区域名称中的一个"\0"字符, which (1)中间人攻击者可以借助一个合法资格权威发放的一个人工服务器骗取任意SSL-based PostgreSQL，并且(2)远程攻击者可以借助一个合法资格权威发放的一个人工客户资格绕过客户机-主机名称。

AI Predicted 7.4 Difficulty: Easy EPSS 2.13% · P82

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2009-4034

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
PostgreSQL NULL Character CA SSL资格确认安全绕过漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PostgreSQL 是一个自由的对象-关系数据库服务器(数据库管理系统)。 PostgreSQL不能正确处理一个X.509证书的主题Common Name (CN)字段中的区域名称中的一个"\0"字符, which (1)中间人攻击者可以借助一个合法资格权威发放的一个人工服务器骗取任意SSL-based PostgreSQL，并且(2)远程攻击者可以借助一个合法资格权威发放的一个人工客户资格绕过客户机-主机名称。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2009-4034

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2009-4034

请登录查看更多情报信息。

Vendor Advisories for CVE-2009-4034 (6)

Mailing List Discussions for CVE-2009-4034 (2)

Other References for CVE-2009-4034 (10)

Same Patch Batch · n/a · 2009-12-15 · 6 CVEs total

CVE-2009-1380 Red Hat JBoss Enterprise Application Platform 跨站脚本漏洞
CVE-2009-2405 Red Hat JBoss Enterprise Application Platform 跨站脚本漏洞
CVE-2009-3554 Red Hat JBoss企业应用平台敏感信息泄露漏洞
CVE-2009-4136 PostgreSQL Index函数本地会话状态修改权限升级漏洞
CVE-2009-4324 Adobe Reader和Acrobat ZLib压缩流特制PDF文件释放后使用漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2009-4034

No comments yet

Leave a comment