A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2566 advisory.

  - postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

  - postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

  - postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

  - postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

  - postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

  - postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

  - postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3816 advisory.

  - postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

  - postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

  - postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

  - postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2511 advisory.

  - postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

  - postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

  - postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

  - postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

  - postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

  - postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the postgresql package has been released.

This update for postgresql94 fixes the following issues :

Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925).

Bug fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.4/static/release-9-4-17.html

  - https://www.postgresql.org/docs/9.4/static/release-9-4-16.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql94 fixes the following issues: Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925). Bug     fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.4/static/release-9-4-17.html

  - https://www.postgresql.org/docs/9.4/static/release-9-4-16.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. (CVE-2018-1058)

This update for postgresql96 fixes the following issues: Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925). Bug     fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.6/static/release-9-6-8.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql96 fixes the following issues :

Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925).

Bug fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.6/static/release-9-6-8.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql95 fixes the following issues :

Security issue fixed in PostgreSQL 9.5.12 :

  - CVE-2018-1058: Uncontrolled search path element in     pg_dump and other client applications (boo#1081925).

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.22, 9.4.x prior to 9.4.17, 9.5.x prior to 9.5.12, 9.6.x prior to 9.6.8, or 10.x prior to 10.3. It is, therefore, affected by a privilege escalation vulnerability.

It was discovered that PostgreSQL incorrectly handled certain settings. An attacker could possibly use this issue to execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PostgreSQL project reports :

- CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications

ID	Name	Product	Family	Severity
194117	RHEL 6 / 7 : rh-postgresql96-postgresql (RHSA-2018:2566)	Nessus	Red Hat Local Security Checks	critical
194110	RHEL 7 : CloudForms 4.6.6 (RHSA-2018:3816)	Nessus	Red Hat Local Security Checks	high
194013	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2018:2511)	Nessus	Red Hat Local Security Checks	high
121931	Photon OS 2.0: Postgresql PHSA-2018-2.0-0031	Nessus	PhotonOS Local Security Checks	high
121817	Photon OS 1.0: Postgresql PHSA-2018-1.0-0122	Nessus	PhotonOS Local Security Checks	high
108932	openSUSE Security Update : postgresql94 (openSUSE-2018-340)	Nessus	SuSE Local Security Checks	high
108873	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2018:0876-1)	Nessus	SuSE Local Security Checks	high
108851	Amazon Linux AMI : postgresql93 / postgresql94,postgresql95,postgresql96 (ALAS-2018-990)	Nessus	Amazon Linux Local Security Checks	high
108531	SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2018:0756-1)	Nessus	SuSE Local Security Checks	high
108530	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2018:0755-1)	Nessus	SuSE Local Security Checks	high
108527	openSUSE Security Update : postgresql96 (openSUSE-2018-287)	Nessus	SuSE Local Security Checks	high
108443	openSUSE Security Update : postgresql95 (openSUSE-2018-279)	Nessus	SuSE Local Security Checks	high
107226	PostgreSQL 9.3.x < 9.3.22 / 9.4.x < 9.4.17 / 9.5.x < 9.5.12 / 9.6.x < 9.6.8 / 10.x < 10.3 Privilege Escalation Vulnerability	Nessus	Databases	high
107192	Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerability (USN-3589-1)	Nessus	Ubuntu Local Security Checks	high
107112	FreeBSD : PostgreSQL vulnerabilities (e3eeda2e-1d67-11e8-a2ec-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-1058

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high