CVE catalog
CVE-2009-4034
postgresql-7.4 postgresql-8.1 postgresql-8.3 - several vulnerabilities
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.13% · Oct 25, 2026
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | postgresql-8.1 | 4.0 | 8.1.10-0etch1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.10-1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.11-0etch1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.11-1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.13-0etch1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.15-0etch1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.17-0etch1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.18-0etch1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.8-1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.8-2 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.9-0etch1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.9-0etch2 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.9-1 | vulnerable |
| Debian | postgresql-8.1 | 4.0 | 8.1.19-0etch1 | fixed |
| Debian | postgresql-7.4 | 4.0 | 1:7.4.16-1 | vulnerable |
| Debian | postgresql-7.4 | 4.0 | 1:7.4.17-0etch1 | vulnerable |
| Debian | postgresql-7.4 | 4.0 | 1:7.4.17-1 | vulnerable |
| Debian | postgresql-7.4 | 4.0 | 1:7.4.19-0etch1 | vulnerable |
| Debian | postgresql-7.4 | 4.0 | 1:7.4.23-0etch1 | vulnerable |
| Debian | postgresql-7.4 | 4.0 | 1:7.4.26-0etch1 | vulnerable |
| Debian | postgresql-7.4 | 4.0 | 1:7.4.27-0etch1 | fixed |
| Debian | postgresql-8.3 | 5.0 | 8.3.5-1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.5-2 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.6-1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.6-1~bpo40+1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.7-0lenny1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.7-0lenny1~bpo40+1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.7-1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.7-2 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.7-3 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.7-4 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.8-0lenny1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.8-0lenny1~bpo40+1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.8-0lenny1~bpo40+2 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.8-1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.8-1+sh4 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.9-0lenny1~bpo40+1 | vulnerable |
| Debian | postgresql-8.3 | 5.0 | 8.3.9-0lenny1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | postgresql-8.1 | deb | 4.0 | 8.1.19-0etch1 | Not reported | DSA-1964-1 | Not reported |
| Debian | postgresql-7.4 | deb | 4.0 | 1:7.4.27-0etch1 | Not reported | DSA-1964-1 | Not reported |
| Debian | postgresql-8.3 | deb | 5.0 | 8.3.9-0lenny1 | Not reported | DSA-1964-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: