CVE-2017-7485
CVE-2017-7485
Vexday Risk Score
3Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS —EPSS 2.0%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
12 may 2017Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
Productos afectados
The PostgreSQL Global Development Group · PostgreSQL¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
https://access.redhat.com/errata/RHSA-2017:1677https://access.redhat.com/errata/RHSA-2017:1678https://access.redhat.com/errata/RHSA-2017:1838https://access.redhat.com/errata/RHSA-2017:2425https://security.gentoo.org/glsa/201710-06https://www.postgresql.org/about/news/1746/http://www.debian.org/security/2017/dsa-3851http://www.securityfocus.com/bid/98461http://www.securitytracker.com/id/1038476