CVE-2017-7485
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.0%
probabilidad de explotación
2.0%top 21% de las CVE
explotación observada
noninguna fuente lo reporta
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
Productos afectados
The PostgreSQL Global Development Group · PostgreSQLReferencias
https://access.redhat.com/errata/RHSA-2017:1677https://access.redhat.com/errata/RHSA-2017:1678https://access.redhat.com/errata/RHSA-2017:1838https://access.redhat.com/errata/RHSA-2017:2425https://security.gentoo.org/glsa/201710-06https://www.postgresql.org/about/news/1746/http://www.debian.org/security/2017/dsa-3851http://www.securityfocus.com/bid/98461http://www.securitytracker.com/id/1038476