CVE-2009-4034

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8...

5.8 Medium

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploit likelihood

2.13%Down 2.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

Record: CVE-2009-4034
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-4034
Updated: 2026-11-02

EUVDEUVD-2009-4005 No score

Record: EUVD-2009-4005
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6wgc-gv8j-fmpq No score

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8...

Record: GHSA-6wgc-gv8j-fmpq
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10030-1 No score

postgresql94-9.4.10-1.1 on GA media

These are all security issues fixed in the postgresql94-9.4.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10030-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10256-1 No score

postgresql93-9.3.15-1.1 on GA media

These are all security issues fixed in the postgresql93-9.3.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10256-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10273-1 No score

libecpg6-32bit-9.5.4-1.2 on GA media

These are all security issues fixed in the libecpg6-32bit-9.5.4-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10273-1
Updated: 2026-11-02

Affected products

postgresql

Affected packages

Affected packages
Package	Affected	Fixed
`postgresql-8.1` Debian:4.0 From an advisory covering 2 CVEs	before 8.1.19-0etch1, plus listed versions 8.1.10-0etch18.1.10-18.1.11-0etch18.1.11-18.1.13-0etch1 Show 8 moreShow less 8.1.15-0etch18.1.17-0etch18.1.18-0etch18.1.8-18.1.8-28.1.9-0etch18.1.9-0etch28.1.9-1	8.1.19-0etch1
`postgresql-7.4` Debian:4.0 From an advisory covering 2 CVEs	before 1:7.4.27-0etch1, plus listed versions 1:7.4.16-11:7.4.17-0etch11:7.4.17-11:7.4.19-0etch11:7.4.23-0etch11:7.4.26-0etch1	1:7.4.27-0etch1
`postgresql-8.3` Debian:5.0 From an advisory covering 2 CVEs	before 8.3.9-0lenny1, plus listed versions 8.3.5-18.3.5-28.3.6-18.3.6-1~bpo40+18.3.7-0lenny1 Show 11 moreShow less 8.3.7-0lenny1~bpo40+18.3.7-18.3.7-28.3.7-38.3.7-48.3.8-0lenny18.3.8-0lenny1~bpo40+18.3.8-0lenny1~bpo40+28.3.8-18.3.8-1+sh48.3.9-0lenny1~bpo40+1	8.3.9-0lenny1
`postgresql94` openSUSE:Tumbleweed From an advisory covering 35 CVEs	before 9.4.10-1.1	9.4.10-1.1
`postgresql93` openSUSE:Tumbleweed From an advisory covering 40 CVEs	before 9.3.15-1.1	9.3.15-1.1
`postgresql95` openSUSE:Tumbleweed From an advisory covering 37 CVEs	before 9.5.4-1.2	9.5.4-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4034 is a medium vulnerability (CVSS 5.8) in Postgresql, published December 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. No source names a fixed version.

References

Show 57 moreShow less