Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 735
Alerts This Week
Warning Icon 1 735

Debian 9 Stretch DLA-2751-1 Moderate: PostgreSQL 9.6 SSL Renegotiation

debian lts
Calendar Grey August 31, 2021
Dist Debian Esm H88
Ensure that your PostgreSQL 9.6 is updated to address SSL renegotiation vulnerabilities, enhancing overall security in compliance with Debian Advisory DLA-2751-1.
PostgreSQL 9.6.23 fixes this security issue: Disallow SSL renegotiation more completely (Michael Paquier)
Topics%20covered

Topics Covered

security advisory debian security fix moderate severity postgresql ssl issue

Summary

Disallow SSL renegotiation more completely (Michael Paquier)

SSL renegotiation has been disabled for some time, but the server would
still cooperate with a client-initiated renegotiation request. A
maliciously crafted renegotiation request could result in a server crash
(see OpenSSL issue CVE-2021-3449). Disable the feature altogether on
OpenSSL versions that permit doing so, which are 1.1.0h and newer.

For Debian 9 stretch, this problem has been fixed in version
9.6.23-0+deb9u1.

We recommend that you upgrade your postgresql-9.6 packages.

For the detailed security status of postgresql-9.6 please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
important
Lowest
Low
Medium
High
Critical

Package: postgresql-9.6
Version: 9.6.23-0+deb9u1
CVE ID: CVE-2021-3449

Topics%20covered

Topics Covered

security advisory debian security fix moderate severity postgresql ssl issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.