PostgreSQL CVE-2017-7485 Man in the Middle Security Bypass Vulnerability

Bugtraq ID:	98461
Class:	Design Error
CVE:	CVE-2017-7485
Remote:	Yes
Local:	No
Published:	May 11 2017 12:00AM
Updated:	Aug 02 2017 11:09AM
Credit:	Daniel Gustafsson
Vulnerable:	Redhat Software Collections for RHEL 0 Redhat Satellite Managed DB ELS (for RHEL 6) 5.8 Redhat Satellite Managed DB (for RHEL 6) 5.8 Redhat Satellite ELS (for RHEL 6) 5.8 Redhat Satellite (for RHEL 6) 5.8 PostgreSQL PostgreSQL 9.5.6 PostgreSQL PostgreSQL 9.5.4 PostgreSQL PostgreSQL 9.5.1 PostgreSQL PostgreSQL 9.5 PostgreSQL PostgreSQL 9.4.11 PostgreSQL PostgreSQL 9.4.9 PostgreSQL PostgreSQL 9.4.6 PostgreSQL PostgreSQL 9.4.5 PostgreSQL PostgreSQL 9.4.4 PostgreSQL PostgreSQL 9.4.3 PostgreSQL PostgreSQL 9.4.2 PostgreSQL PostgreSQL 9.4.1 PostgreSQL PostgreSQL 9.3.16 PostgreSQL PostgreSQL 9.3.14 PostgreSQL PostgreSQL 9.3.11 PostgreSQL PostgreSQL 9.3.10 PostgreSQL PostgreSQL 9.3.9 PostgreSQL PostgreSQL 9.3.8 PostgreSQL PostgreSQL 9.3.7 PostgreSQL PostgreSQL 9.3.6 PostgreSQL PostgreSQL 9.3.5 PostgreSQL PostgreSQL 9.3.4 PostgreSQL PostgreSQL 9.3.3 PostgreSQL PostgreSQL 9.3.2 PostgreSQL PostgreSQL 9.2.20 PostgreSQL PostgreSQL 9.2.18 PostgreSQL PostgreSQL 9.2.15 PostgreSQL PostgreSQL 9.2.14 PostgreSQL PostgreSQL 9.2.13 PostgreSQL PostgreSQL 9.2.12 PostgreSQL PostgreSQL 9.2.11 PostgreSQL PostgreSQL 9.2.10 PostgreSQL PostgreSQL 9.2.8 PostgreSQL PostgreSQL 9.2.7 PostgreSQL PostgreSQL 9.2.6 PostgreSQL PostgreSQL 9.2.5 PostgreSQL PostgreSQL 9.2.3 PostgreSQL PostgreSQL 9.6.2 PostgreSQL PostgreSQL 9.6.1 PostgreSQL PostgreSQL 9.5.2 PostgreSQL PostgreSQL 9.4 PostgreSQL PostgreSQL 9.3.1 PostgreSQL PostgreSQL 9.3 PostgreSQL PostgreSQL 9.2.4 PostgreSQL PostgreSQL 9.2.2 PostgreSQL PostgreSQL 9.2.1 PostgreSQL PostgreSQL 9.2 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	PostgreSQL PostgreSQL 9.5.7 PostgreSQL PostgreSQL 9.4.12 PostgreSQL PostgreSQL 9.3.17 PostgreSQL PostgreSQL 9.2.21 PostgreSQL PostgreSQL 9.6.3

PostgreSQL CVE-2017-7485 Man in the Middle Security Bypass Vulnerability

PostgreSQL is prone to a security-bypass vulnerability.

Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks.

PostgreSQL 9.2.x through 9.2.21, 9.3.x through 9.3.17, 9.4.x through 9.4.12, 9.5.x through 9.5.7, 9.6.x thorugh 9.6.3 are vulnerable.

PostgreSQL CVE-2017-7485 Man in the Middle Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PostgreSQL CVE-2017-7485 Man in the Middle Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PostgreSQL CVE-2017-7485 Man in the Middle Security Bypass Vulnerability

References:

• PostgreSQL - Homepage (PostgreSQL)
  
• Restore PGREQUIRESSL recognition in libpq. (PostgreSQL)
  
• 2017-05-11 Security Update Release (PostgreSQL)
  
• CVE-2017-7485 postgresql: libpq ignores PGREQUIRESSL environment variable (Redhat)