A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0326 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-5868:
      A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory.

      CVE-2023-5869:
      A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code     through missing overflow checks during SQL array value modification. This issue exists due to an integer     overflow during array modification where a remote user can trigger the overflow by providing specially     crafted data. This enables the execution of arbitrary code on the target system, allowing users to write     arbitrary bytes to memory and extensively read the server's memory.

      CVE-2023-5870:
      A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack.

      CVE-2023-39417:
      IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

      CVE-2023-39418:
      A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a     \000 byte in the middle. (CVE-2024-29509)

  - Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe%     prefix or the | pipe character prefix). (CVE-2023-36664)

  - A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This     issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN     device with gs. (CVE-2023-38559)

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0559 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-39417:
    IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

    CVE-2023-39418:
    A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows.

    CVE-2023-2454:
    schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code.

    CVE-2023-2455:
    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy.

    CVE-2022-41862:
    In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes.

    CVE-2022-2625:
    A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects     in at least one schema, the ability to lure or wait for an administrator to create or update an affected     extension in that schema, and the ability to lure or wait for a victim to use the object targeted in     CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to     run arbitrary code as the victim role, which may be a superuser.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Siemens SINEC NMS installed on the remote host is prior to 2.0.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA-943925 advisory.

  - coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type     request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload,     aka Content-Type confusion between the WAF and the backend application. This occurs when the web     application relies on only the last Content-Type header. Other platforms may reject the additional     Content-Type header or merge conflicting headers, leading to detection as a malformed header.
    (CVE-2023-38199)

  - Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of     RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied     request-target (URL) data and is then re-inserted into the proxied request-target using variable     substitution. For example, something like: RewriteEngine on RewriteRule ^/here/(.*)     http://example.com:8080/elsewhere?$1; [P] ProxyPassReverse /here/ http://example.com:8080/ Request     splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended     URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version     2.4.56 of Apache HTTP Server. (CVE-2023-25690)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7883 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7884 advisory.

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

  - A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through     missing overflow checks during SQL array value modification. This issue exists due to an integer overflow     during array modification where a remote user can trigger the overflow by providing specially crafted     data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary     bytes to memory and extensively read the server's memory. (CVE-2023-5869)

  - A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack. (CVE-2023-5870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7785 advisory.

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

  - A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through     missing overflow checks during SQL array value modification. This issue exists due to an integer overflow     during array modification where a remote user can trigger the overflow by providing specially crafted     data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary     bytes to memory and extensively read the server's memory. (CVE-2023-5869)

  - A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack. (CVE-2023-5870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7884 advisory.

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)
    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)
    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)
    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)
    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7884 advisory.

    - Fixes: CVE-2023-5868 CVE-2023-5869 CVE-2023-5870 CVE-2023-39417 CVE-2023-39418

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7885 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7884 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7785 advisory.

    pgaudit     pg_repack     postgres-decoderbufs     postgresql     [15.5-1]
    - update to 15.5
    - Fixes CVE-2023-5868, CVE-2023-5869, CVE-2023-5870, CVE-2023-39417, and CVE-2023-39418       Resolves: RHEL-16100, RHEL-16124, RHEL-16139

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7785 advisory.

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)
    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)
    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)
    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)
    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7785 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5553 advisory.

    Several vulnerabilities have been discovered in the PostgreSQL database system. CVE-2023-5868 Jingzhou Fu     discovered a memory disclosure flaw in aggregate function calls. CVE-2023-5869 Pedro Gallegos reported     integer overflow flaws resulting in buffer overflows in the array modification functions. CVE-2023-5870     Hemanth Sandrana and Mahendrakar Srinivasarao reported that the pg_cancel_backend role can signal certain     superuser processes, potentially resulting in denial of service. CVE-2023-39417 Micah Gate, Valerie     Woolard, Tim Carey-Smith, and Christoph Berg reported that an extension script using @substitutions@     within quoting may allow to perform an SQL injection for an attacker having database-level CREATE     privileges. CVE-2023-39418 Dean Rasheed reported that the MERGE command fails to enforce UPDATE or SELECT     row security policies. For the stable distribution (bookworm), these problems have been fixed in version     15.5-0+deb12u1. We recommend that you upgrade your postgresql-15 packages. For the detailed security     status of postgresql-15 please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/postgresql-15

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-387 advisory.

    2024-02-29: CVE-2022-41862 was added to this advisory.

    In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes. (CVE-2022-41862)

    While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario     involving function inlining. This leads to potentially incorrect policies being applied in cases where     role-specific policies are used and a given query is planned under one role and then executed under other     roles. This scenario can happen under security definer functions or when a common user and query is     planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a     user to complete otherwise-forbidden reads and modifications. This affects only databases that have used     CREATE POLICY to define a row security policy. (CVE-2023-2455)

    A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3342-1 advisory.

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3347-1 advisory.

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6296-1 advisory.

    It was discovered that PostgreSQL incorrectly handled certain extension script substitutions. An attacker     having database-level CREATE privileges can use this issue to execute arbitrary code as the bootstrap     superuser. (CVE-2023-39417)

    It was discovered that PostgreSQL incorrectly handled the MERGE command. A remote attacker could possibly     use this issue to bypass certain UPDATE and SELECT policies. This issue only affected Ubuntu 23.04.
    (CVE-2023-39418)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 11 prior to 11.21, 12 prior to 12.16, 13 prior to 13.12, 14 prior to 14.9, or 15 prior to 15.4. As such, it is potentially affected by a vulnerability :

  - An extension script is vulnerable if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting     construct (dollar quoting, '', or ). No bundled extension is vulnerable. Vulnerable uses do appear in a     documentation example and in non-bundled extensions. Hence, the attack prerequisite is an administrator having     installed files of a vulnerable, trusted, non-bundled extension. Subject to that prerequisite, this enables an     attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. PostgreSQL     will block this attack in the core server, so there's no need to modify individual extensions. (CVE-2023-39417)

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row     security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies     do not forbid, a user could store such rows. (CVE-2023-39418)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 15 prior to 15.4. As such, it is potentially affected by a vulnerability :

  - PostgreSQL 15 introduced the MERGE command, which fails to test new rows against row security policies     defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some row that INSERT policies do not forbid, a     user could store such rows. Subsequent consequences are application-dependent. This affects only databases     that have used CREATE POLICY to define a row security policy.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 59a43a73-3786-11ee-94b4-6cc21735f730 advisory.

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
276063	TencentOS Server 3: postgresql:15 (TSSA-2023:0326)	Nessus	Tencent Local Security Checks	high
242730	NewStart CGSL MAIN 7.02 : ghostscript Multiple Vulnerabilities (NS-SA-2025-0121)	Nessus	NewStart CGSL Local Security Checks	high
239960	TencentOS Server 4: postgresql (TSSA-2024:0559)	Nessus	Tencent Local Security Checks	high
191429	Siemens SINEC NMS < V2.0 SP1 Multiple Vulnerabilities	Nessus	Windows	critical
189663	RHEL 8 : postgresql:15 (RHSA-2023:7883)	Nessus	Red Hat Local Security Checks	high
187740	CentOS 8 : postgresql:15 (CESA-2023:7884)	Nessus	CentOS Local Security Checks	high
187706	Rocky Linux 9 : postgresql:15 (RLSA-2023:7785)	Nessus	Rocky Linux Local Security Checks	high
187214	AlmaLinux 8 : postgresql:15 (ALSA-2023:7884)	Nessus	Alma Linux Local Security Checks	high
187183	Oracle Linux 8 : postgresql:15 (ELSA-2023-7884)	Nessus	Oracle Linux Local Security Checks	high
187126	RHEL 9 : postgresql:15 (RHSA-2023:7885)	Nessus	Red Hat Local Security Checks	high
187125	RHEL 8 : postgresql:15 (RHSA-2023:7884)	Nessus	Red Hat Local Security Checks	high
186961	Oracle Linux 9 : postgresql:15 (ELSA-2023-7785)	Nessus	Oracle Linux Local Security Checks	high
186948	AlmaLinux 9 : postgresql:15 (ALSA-2023:7785)	Nessus	Alma Linux Local Security Checks	high
186849	RHEL 9 : postgresql:15 (RHSA-2023:7785)	Nessus	Red Hat Local Security Checks	high
185520	Debian DSA-5553-1 : postgresql-15 - security update	Nessus	Debian Local Security Checks	high
183804	Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-387)	Nessus	Amazon Linux Local Security Checks	medium
179968	SUSE SLES12 Security Update : postgresql15 (SUSE-SU-2023:3342-1)	Nessus	SuSE Local Security Checks	high
179967	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postgresql15 (SUSE-SU-2023:3347-1)	Nessus	SuSE Local Security Checks	high
179929	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : PostgreSQL vulnerabilities (USN-6296-1)	Nessus	Ubuntu Local Security Checks	high
179922	PostgreSQL 11.x < 11.21 / 12.x < 12.16 / 13.x < 13.12 / 14.x < 14.9 / 15.x < 15.4 Multiple Vulnerabilities	Nessus	Databases	high
179921	PostgreSQL 15.x < 15.4 Protection Mechanism Failure	Nessus	Databases	medium
179869	FreeBSD : postgresql-server -- MERGE fails to enforce UPDATE or SELECT row security policies (59a43a73-3786-11ee-94b4-6cc21735f730)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2023-39418

medium

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

medium

medium