CVE-2017-7485 Security feature bypass in PostgreSQL
An active Man-in-the-Middle attacker can strip SSL/TLS protection from PostgreSQL connections if the PGREQUIRESSL environment variable is used, exposing data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7485?
CVE-2017-7485 is a medium-severity vulnerability in Postgresql Postgresql, published on 12 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
Which versions are affected by CVE-2017-7485?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2017-7485?
Upgrade to a fixed version.
Is CVE-2017-7485 being exploited?
There is no known exploitation of CVE-2017-7485 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2017-7485, CLEANSTART-2026-KW67174, GHSA-742m-4pjq-x8qf, UBUNTU-CVE-2017-7485.