CVE-2009-3231: Canonical Ubuntu Linux

Medium severity, CVSS 6.8. EPSS: 7.6% chance of exploitation in the next 30 days.

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only
• Fedoraproject Fedora: version 10 only; version 11 only
• Opensuse Opensuse: from 10.3, up to and including 11.1
• PostgreSQL PostgreSQL: from 8.2, before 8.2.14 (fixed in 8.2.14); from 8.3, before 8.3.8 (fixed in 8.3.8)
• Suse Linux Enterprise: version 10.0 only; version 11.0 only
• Suse Linux Enterprise Server: version 9 only

Published 2009-09-17. Last modified 2026-06-16.