CVE-2009-4034

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8...

5.8 MediumFix available

CVE-2009-4034 is a medium vulnerability (CVSS 5.8) in Postgresql, published December 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 81st percentile. Fixed in postgresql-8.1 8.1.19-0etch1.

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploit likelihood

2.13%Down 2.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

Record: CVE-2009-4034
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-4034
Updated: 2026-11-02

EUVDEUVD-2009-4005 No score

Record: EUVD-2009-4005
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6wgc-gv8j-fmpq No score

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8...

Record: GHSA-6wgc-gv8j-fmpq
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10030-1 No score

postgresql94-9.4.10-1.1 on GA media

These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10030-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10256-1 No score

postgresql93-9.3.15-1.1 on GA media

These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10256-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10273-1 No score

libecpg6-32bit-9.5.4-1.2 on GA media

These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10273-1
Updated: 2026-11-02

Affected products

postgresql

Affected packages

Affected packages
Package	Affected	Fixed
`postgresql-8.1` Debian:4.0	before 8.1.19-0etch1, plus listed versions 8.1.10-0etch18.1.10-18.1.11-0etch18.1.11-18.1.13-0etch1 Show 8 moreShow less 8.1.15-0etch18.1.17-0etch18.1.18-0etch18.1.8-18.1.8-28.1.9-0etch18.1.9-0etch28.1.9-1	8.1.19-0etch1
`postgresql-7.4` Debian:4.0	before 1:7.4.27-0etch1, plus listed versions 1:7.4.16-11:7.4.17-0etch11:7.4.17-11:7.4.19-0etch11:7.4.23-0etch11:7.4.26-0etch1	1:7.4.27-0etch1
`postgresql-8.3` Debian:5.0	before 8.3.9-0lenny1, plus listed versions 8.3.5-18.3.5-28.3.6-18.3.6-1~bpo40+18.3.7-0lenny1 Show 11 moreShow less 8.3.7-0lenny1~bpo40+18.3.7-18.3.7-28.3.7-38.3.7-48.3.8-0lenny18.3.8-0lenny1~bpo40+18.3.8-0lenny1~bpo40+28.3.8-18.3.8-1+sh48.3.9-0lenny1~bpo40+1	8.3.9-0lenny1
`postgresql94` openSUSE:Tumbleweed	before 9.4.10-1.1	9.4.10-1.1
`postgresql93` openSUSE:Tumbleweed	before 9.3.15-1.1	9.3.15-1.1
`postgresql95` openSUSE:Tumbleweed	before 9.5.4-1.2	9.5.4-1.2

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 57 moreShow less