CVE-2017-7485

Publication date 12 May 2017

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
postgresql-9.1	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
postgresql-9.3	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Fixed 9.3.17-0ubuntu0.14.04
postgresql-9.5	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.10 yakkety	Ignored end of life
	16.04 LTS xenial	Fixed 9.5.7-0ubuntu0.16.04
	14.04 LTS trusty	Not in release
postgresql-9.6	17.10 artful	Not affected
	17.04 zesty	Fixed 9.6.3-0ubuntu0.17.04
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
postgresql-9.6	Upstream: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=aafbd1df969135c185947c596c46608fc9f4a67c

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N