Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
PostgreSQL Missing Encryption of Sensitive Data Vulnerability - CVE-2017-7485 - Vulnerability Database
PostgreSQL

PostgreSQL Missing Encryption of Sensitive Data Vulnerability - CVE-2017-7485

Medium
Reference: CVE-2017-7485
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2017-7485
Title: PostgreSQL Missing Encryption of Sensitive Data Vulnerability
Overview:

In PostgreSQL 9.3.x before 9.3.17 9.4.x before 9.4.12 9.5.x before 9.5.7 and 9.6.x before 9.6.3 it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.