It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2565 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql10-postgresql (10.5).
    (BZ#1612673, BZ#1614337)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges     Andrew Krasichkov as the original reporter of CVE-2018-10915; and Stephen Frost as the original reporter     of CVE-2018-1115.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2566 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql96-postgresql     (9.6.10). (BZ#1614340)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, CVE-2017-15099, and CVE-2018-1115. Upstream acknowledges Andrew Krasichkov     as the original reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom     Lane as the original reporter of CVE-2018-1053; Dean Rasheed as the original reporter of CVE-2017-15099;
    and Stephen Frost as the original reporter of CVE-2018-1115.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3816 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925 and     CVE-2018-1053. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915; and Tom     Lane as the original reporter of CVE-2018-1053.

    Additional Changes:

    This update fixes various bugs and adds enhancements. Documentation for these changes is available from     the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2511 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql     (9.5.14). (BZ#1612671)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, and CVE-2017-15099. Upstream acknowledges Andrew Krasichkov as the original     reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom Lane as the     original reporter of CVE-2018-1053; and Dean Rasheed as the original reporter of CVE-2017-15099.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql96, postgresql10 and postgresql12 fixes the following issues :

postgresql10 was updated to 10.13 (bsc#1171924).

https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/10/release-10-13.html

postgresql10 was updated to 10.12 (CVE-2020-1720, bsc#1163985)

- https://www.postgresql.org/about/news/2011/

- https://www.postgresql.org/docs/10/release-10-12.html

postgresql10 was updated to 10.11 :

- https://www.postgresql.org/about/news/1994/

- https://www.postgresql.org/docs/10/release-10-11.html

postgresql12 was updated to 12.3 (bsc#1171924).

Bug Fixes and Improvements :

  - Several fixes for GENERATED columns, including an issue     where it was possible to crash or corrupt data in a     table when the output of the generated column was the     exact copy of a physical column on the table, e.g. if     the expression called a function which could return its     own input.

  - Several fixes for ALTER TABLE, including ensuring the     SET STORAGE directive is propagated to a table's     indexes.

  - Fix a potential race condition when using DROP OWNED BY     while another session is deleting the same objects.

  - Allow for a partition to be detached when it has     inherited ROW triggers.

  - Several fixes for REINDEX CONCURRENTLY, particularly     with issues when a REINDEX CONCURRENTLY operation fails.

  - Fix crash when COLLATE is applied to an uncollatable     type in a partition bound expression.

  - Fix performance regression in floating point     overflow/underflow detection.

  - Several fixes for full text search, particularly with     phrase searching.

  - Fix query-lifespan memory leak for a set-returning     function used in a query's FROM clause.

  - Several reporting fixes for the output of VACUUM     VERBOSE.

  - Allow input of type circle to accept the format (x,y),r,     which is specified in the documentation.

  - Allow for the get_bit() and set_bit() functions to not     fail on bytea strings longer than 256MB.

  - Avoid premature recycling of WAL segments during crash     recovery, which could lead to WAL segments being     recycled before being archived.

  - Avoid attempting to fetch nonexistent WAL files from     archive storage during recovery by skipping irrelevant     timelines.

  - Several fixes for logical replication and replication     slots.

  - Fix several race conditions in synchronous standby     management, including one that occurred when changing     the synchronous_standby_names setting.

  - Several fixes for GSSAPI support, include a fix for a     memory leak that occurred when using GSSAPI encryption.

  - Ensure that members of the pg_read_all_stats role can     read all statistics views.

  - Fix performance regression in     information_schema.triggers view.

  - Fix memory leak in libpq when using sslmode=verify-full.

  - Fix crash in psql when attempting to re-establish a     failed connection.

  - Allow tab-completion of the filename argument to \gx     command in psql.

  - Add pg_dump support for ALTER ... DEPENDS ON EXTENSION.

  - Several other fixes for pg_dump, which include dumping     comments on RLS policies and postponing restore of event     triggers until the end.

  - Ensure pg_basebackup generates valid tar files.

  - pg_checksums skips tablespace subdirectories that belong     to a different PostgreSQL major version

  - Several Windows compatibility fixes

This update also contains timezone tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.

For more details, check out :

  - https://www.postgresql.org/docs/12/release-12-3.html

Other fixes :

  - Let postgresqlXX conflict with postgresql-noarch <     12.0.1 to get a clean and complete cutover to the new     packaging schema.

postgresql96 was updated to 9.6.19 :

  - CVE-2020-14350, boo#1175194: Make contrib modules'     installation scripts more secure.

  - https://www.postgresql.org/docs/9.6/release-9-6-19.html

  - Pack the /usr/lib/postgresql symlink only into the main     package.

  - Let postgresqlXX conflict with postgresql-noarch <     12.0.1 to get a clean and complete cutover to the new     packaging schema.

  - update to 9.6.18 (boo#1171924).
    https://www.postgresql.org/about/news/2038/     https://www.postgresql.org/docs/9.6/release-9-6-18.html

  - Unify the spec file to work across all current     PostgreSQL versions to simplify future maintenance.

  - Move from the 'libs' build flavour to a 'mini' package     that will only be used inside the build service and not     get shipped, to avoid confusion with the debuginfo     packages (boo#1148643).

  - update to 9.6.17 (CVE-2020-1720, boo#1163985)     https://www.postgresql.org/about/news/2011/     https://www.postgresql.org/docs/9.6/release-9-6-17.html

  - use and package the sha256 checksum for for source

  - update to 9.6.16:
    https://www.postgresql.org/about/news/1994/     https://www.postgresql.org/docs/9.6/release-9-6-16.html

  - add requires to the devel package for the libs that are     returned by pg_config --libs

  - Update to 9.6.15 :

  - https://www.postgresql.org/about/news/1960/

  - https://www.postgresql.org/docs/9.6/release-9-6-15.html

  - CVE-2019-10208, boo#1145092: TYPE in pg_temp executes     arbitrary SQL during SECURITY DEFINER execution.

  - Use FAT LTO objects in order to provide proper static     library.

  - Update to 9.6.14:
    https://www.postgresql.org/docs/9.6/release-9-6-14.html

  - Update to 9.6.13 :

  - https://www.postgresql.org/docs/9.6/release-9-6-13.html

  - https://www.postgresql.org/about/news/1939/

  - CVE-2019-10130, boo#1134689: Prevent row-level security     policies from being bypassed via selectivity estimators.

  - Make the server-devel package exclusive across versions.

  - Update to 9.6.12 :

  - https://www.postgresql.org/docs/9.6/release-9-6-12.html

  - https://www.postgresql.org/about/news/1920/

  - By default, panic instead of retrying after fsync()     failure, to avoid possible data corruption.

  - Numerous other bug fixes.

  - Overhaul README.SUSE

  - Update to 9.6.11 :

  - Numerous bug fixes, see the release notes:
    https://www.postgresql.org/docs/9.6/release-9-6-11.html

  - Remove unneeded library dependencies from PGXS.

  - add provides for the new server-devel package that will     be introduced in postgresql 11

  - Update to 9.6.10:
    https://www.postgresql.org/docs/current/static/release-9
    -6-10.html

  - CVE-2018-10915, boo#1104199: Fix failure to reset     libpq's state fully between connection attempts.

  - CVE-2018-10925, boo#1104202: Fix INSERT ... ON CONFLICT     UPDATE through a view that isn't just SELECT * FROM ...

  - Update to 9.6.9:
    https://www.postgresql.org/about/news/1851/     https://www.postgresql.org/docs/current/static/release-9
    -6-9.html A dump/restore is not required for those     running 9.6.X. However, if you use the adminpack     extension, you should update it as per the first     changelog entry below. Also, if the function marking     mistakes mentioned in the second and third changelog     entries below affect you, you will want to take steps to     correct your database catalogs.

  - CVE-2018-1115, boo#1091610: Remove public execute     privilege from contrib/adminpack's pg_logfile_rotate()     function pg_logfile_rotate() is a deprecated wrapper for     the core function pg_rotate_logfile(). When that     function was changed to rely on SQL privileges for     access control rather than a hard-coded superuser check,     pg_logfile_rotate() should have been updated as well,     but the need for this was missed. Hence, if adminpack is     installed, any user could request a logfile rotation,     creating a minor security issue. After installing this     update, administrators should update adminpack by     performing ALTER EXTENSION adminpack UPDATE in each     database in which adminpack is installed.

  - Fix incorrect volatility markings on a few built-in     functions

  - Fix incorrect parallel-safety markings on a few built-in     functions.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for postgresql10 fixes the following issues :

PostgreSQL 10 was updated to 10.5 :

- https://www.postgresql.org/about/news/1851/

- https://www.postgresql.org/docs/current/static/release-10-5.html

  A dump/restore is not required for those running 10.X.
  However, if you use the adminpack extension, you should   update it as per the first changelog entry below. Also, if   the function marking mistakes mentioned in the second and   third changelog entries below affect you, you will want to   take steps to correct your database catalogs.

Security issues fixed :

  - CVE-2018-1115: Remove public execute privilege from     contrib/adminpack's pg_logfile_rotate() function     pg_logfile_rotate() is a deprecated wrapper for the core     function pg_rotate_logfile(). When that function was     changed to rely on SQL privileges for access control     rather than a hard-coded superuser check,     pg_logfile_rotate() should have been updated as well,     but the need for this was missed. Hence, if adminpack is     installed, any user could request a logfile rotation,     creating a minor security issue. After installing this     update, administrators should update adminpack by     performing ALTER EXTENSION adminpack UPDATE in each     database in which adminpack is installed (bsc#1091610).

  - CVE-2018-10915: libpq failed to properly reset its     internal state between connections. If an affected     version of libpq was used with 'host' or 'hostaddr'     connection parameters from untrusted input, attackers     could have bypassed client-side connection security     features, obtain access to higher privileged connections     or potentially cause other impact SQL injection, by     causing the PQescape() functions to malfunction     (bsc#1104199)

  - CVE-2018-10925: Add missing authorization check on     certain statements involved with 'INSERT ... ON CONFLICT     DO UPDATE'. An attacker with 'CREATE TABLE' privileges     could have exploited this to read arbitrary bytes server     memory. If the attacker also had certain 'INSERT' and     limited 'UPDATE' privileges to a particular table, they     could have exploited this to update other columns in the     same table (bsc#1104202).

This update was imported from the SUSE:SLE-15:Update update project.

An update of the postgresql package has been released.

update to 10.5, CVE-2018-10915, CVE-2018-10925

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql10 fixes the following issues :

PostgreSQL 10 was updated to 10.5 :

https://www.postgresql.org/about/news/1851/

https://www.postgresql.org/docs/current/static/release-10-5.html

A dump/restore is not required for those running 10.X. However, if you use the adminpack extension, you should update it as per the first changelog entry below. Also, if the function marking mistakes mentioned in the second and third changelog entries below affect you, you will want to take steps to correct your database catalogs.

Security issues fixed: CVE-2018-1115: Remove public execute privilege from contrib/adminpack's pg_logfile_rotate() function pg_logfile_rotate() is a deprecated wrapper for the core function pg_rotate_logfile(). When that function was changed to rely on SQL privileges for access control rather than a hard-coded superuser check, pg_logfile_rotate() should have been updated as well, but the need for this was missed. Hence, if adminpack is installed, any user could request a logfile rotation, creating a minor security issue.
After installing this update, administrators should update adminpack by performing ALTER EXTENSION adminpack UPDATE in each database in which adminpack is installed (bsc#1091610).

CVE-2018-10915: libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could have bypassed client-side connection security features, obtain access to higher privileged connections or potentially cause other impact SQL injection, by causing the PQescape() functions to malfunction (bsc#1104199)

CVE-2018-10925: Add missing authorization check on certain statements involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE TABLE' privileges could have exploited this to read arbitrary bytes server memory. If the attacker also had certain 'INSERT' and limited 'UPDATE' privileges to a particular table, they could have exploited this to update other columns in the same table (bsc#1104202).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction.(CVE-2018-10915)

It was discovered that PostgreSQL failed to properly check authorization on certain statements involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE TABLE' privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain 'INSERT' and limited 'UPDATE' privileges to a particular table, they could exploit this to update other columns in the same table.(CVE-2018-10925)

It was found that pg_catalog.pg_logfile_rotate(), from the adminpack extension, did not follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could use this flaw to force log rotation.(CVE-2018-1115 )

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction.(CVE-2018-10915)

It was discovered that PostgreSQL failed to properly check authorization on certain statements involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE TABLE' privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain 'INSERT' and limited 'UPDATE' privileges to a particular table, they could exploit this to update other columns in the same table.(CVE-2018-10925)

The remote host is affected by the vulnerability described in GLSA-201810-08 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the referenced CVE identifiers for details.
    In addition it was discovered that Gentoo&rsquo;s PostgreSQL installation       suffered from a privilege escalation vulnerability due to a runscript       which called OpenRC&rsquo;s checkpath() on a user controlled path and allowed       user running PostgreSQL to kill arbitrary processes via PID file       manipulation.
  Impact :

    A remote attacker could bypass certain client-side connection security       features, read arbitrary server memory or alter certain data.
    In addition, a local attacker could gain privileges or cause a Denial of       Service condition by  killing arbitrary processes.
  Workaround :

    There is no known workaround at this time.

This update for postgresql96 to 9.6.10 fixes the following issues :

These security issues were fixed :

  - CVE-2018-10915: libpq failed to properly reset its     internal state between connections. If an affected     version of libpq was used with 'host' or 'hostaddr'     connection parameters from untrusted input, attackers     could have bypassed client-side connection security     features, obtain access to higher privileged connections     or potentially cause other impact SQL injection, by     causing the PQescape() functions to malfunction     (bsc#1104199)

  - CVE-2018-10925: Add missing authorization check on     certain statements involved with 'INSERT ... ON CONFLICT     DO UPDATE'. An attacker with 'CREATE TABLE' privileges     could have exploited this to read arbitrary bytes server     memory. If the attacker also had certain 'INSERT' and     limited 'UPDATE' privileges to a particular table, they     could have exploited this to update other columns in the     same table (bsc#1104202)

For addition details please see https://www.postgresql.org/docs/current/static/release-9-6-10.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql96 to 9.6.10 fixes the following issues :

These security issues were fixed :

CVE-2018-10915: libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could have bypassed client-side connection security features, obtain access to higher privileged connections or potentially cause other impact SQL injection, by causing the PQescape() functions to malfunction (bsc#1104199)

CVE-2018-10925: Add missing authorization check on certain statements involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE TABLE' privileges could have exploited this to read arbitrary bytes server memory. If the attacker also had certain 'INSERT' and limited 'UPDATE' privileges to a particular table, they could have exploited this to update other columns in the same table (bsc#1104202)

For addition details please see https://www.postgresql.org/docs/current/static/release-9-6-10.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.24, 9.4.x prior to 9.4.19, 9.5.x prior to 9.5.14, 9.6.x prior to 9.6.10, or 10.x prior to 10.5. It is, therefore, affected by multiple vulnerabilities.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3744-1 advisory.

    Andrew Krasichkov discovered that the PostgreSQL client library incorrectly reset its internal state     between connections. A remote attacker could possibly use this issue to bypass certain client-side     connection security features. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2018-10915)

    It was discovered that PostgreSQL incorrectly checked authorization on certain statements. A remote     attacker could possibly use this issue to read arbitrary server memory or alter certain data.
    (CVE-2018-10925)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

update to 9.6.10, CVE-2018-10915 CVE-2018-10925

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PostgreSQL project reports :

CVE-2018-10915: Certain host connection parameters defeat client-side security defenses

libpq, the client connection API for PostgreSQL that is also used by other connection libraries, had an internal issue where it did not reset all of its connection state variables when attempting to reconnect. In particular, the state variable that determined whether or not a password is needed for a connection would not be reset, which could allow users of features requiring libpq, such as the 'dblink' or 'postgres_fdw' extensions, to login to servers they should not be able to access.

CVE-2018-10925: Memory disclosure and missing authorization in `INSERT ... ON CONFLICT DO UPDATE`

An attacker able to issue CREATE TABLE can read arbitrary bytes of server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`) query. By default, any user can exploit that. A user that has specific INSERT privileges and an UPDATE privilege on at least one column in a given table can also update other columns using a view and an upsert query.

Two vulnerabilities have been found in the PostgreSQL database system :

  - CVE-2018-10915     Andrew Krasichkov discovered that libpq did not reset     all its connection state during reconnects.

  - CVE-2018-10925     It was discovered that some 'CREATE TABLE' statements     could disclose server memory.

For additional information please refer to the upstream announcement at https://www.postgresql.org/about/news/1878/

ID	Name	Product	Family	Severity
194127	RHEL 7 : rh-postgresql10-postgresql (RHSA-2018:2565)	Nessus	Red Hat Local Security Checks	critical
194117	RHEL 6 / 7 : rh-postgresql96-postgresql (RHSA-2018:2566)	Nessus	Red Hat Local Security Checks	critical
194110	RHEL 7 : CloudForms 4.6.6 (RHSA-2018:3816)	Nessus	Red Hat Local Security Checks	high
194013	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2018:2511)	Nessus	Red Hat Local Security Checks	high
139655	openSUSE Security Update : postgresql96 / postgresql10 and postgresql12 (openSUSE-2020-1227)	Nessus	SuSE Local Security Checks	critical
123286	openSUSE Security Update : postgresql10 (openSUSE-2019-659)	Nessus	SuSE Local Security Checks	critical
121988	Photon OS 2.0: Postgresql PHSA-2018-2.0-0087	Nessus	PhotonOS Local Security Checks	high
121879	Photon OS 1.0: Postgresql PHSA-2018-1.0-0178	Nessus	PhotonOS Local Security Checks	high
120455	Fedora 28 : postgresql (2018-5d1f7bd2d7)	Nessus	Fedora Local Security Checks	high
120090	SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2018:2564-1)	Nessus	SuSE Local Security Checks	critical
119478	Amazon Linux AMI : postgresql96 (ALAS-2018-1119)	Nessus	Amazon Linux Local Security Checks	critical
119477	Amazon Linux AMI : postgresql95 (ALAS-2018-1118)	Nessus	Amazon Linux Local Security Checks	high
118508	GLSA-201810-08 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
118448	openSUSE Security Update : postgresql96 (openSUSE-2018-1278)	Nessus	SuSE Local Security Checks	high
118387	SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2018:3377-1)	Nessus	SuSE Local Security Checks	high
117603	Amazon Linux AMI : postgresql93 / postgresql94,postgresql95 (ALAS-2018-1079)	Nessus	Amazon Linux Local Security Checks	high
117346	Amazon Linux AMI : postgresql96 (ALAS-2018-1074)	Nessus	Amazon Linux Local Security Checks	high
112269	openSUSE Security Update : postgresql10 (openSUSE-2018-955)	Nessus	SuSE Local Security Checks	critical
111966	PostgreSQL 9.3.x < 9.3.24 / 9.4.x < 9.4.19 / 9.5.x < 9.5.14 / 9.6.x < 9.6.10 / 10.x < 10.5 Multiple Vulnerabilities	Nessus	Databases	high
111844	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PostgreSQL vulnerabilities (USN-3744-1)	Nessus	Ubuntu Local Security Checks	high
111770	Fedora 27 : postgresql (2018-d8f5aea89d)	Nessus	Fedora Local Security Checks	high
111656	FreeBSD : PostgreSQL -- two vulnerabilities (96eab874-9c79-11e8-b34b-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
111653	Debian DSA-4269-1 : postgresql-9.6 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10925

high

Tenable Plugins

critical

critical

high

high

critical

critical

high

high

high

critical

critical

high

critical

high

high

high

high

critical

high

high

high

high

high