The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7694 advisory.

  - postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

  - postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)

  - postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)

  - postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)

  - postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  - postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

  - postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : postgresql:12 (RHSA-2023:7694)

high Nessus Plugin ID 186665

Version 1.7

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.3

Version 1.3

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.0

Version 1.7 Feb 16, 2024, 12:17 PM IAVM reference Plugin Feed: 202402161217
Version 1.6 Jan 26, 2024, 11:18 PM Plugin metadata Reference Plugin Feed: 202401262318
Version 1.5 Dec 18, 2023, 2:01 PM CVSSv2 score source (changed from "CVE-2023-39417" to "CVE-2023-5869") CVSSv3 score source (changed from "CVE-2023-5869" to none) Plugin Feed: 202312181401
Version 1.5 Jan 26, 2024, 9:00 PM Plugin metadata Reference Plugin Feed: 202401262100
Version 1.4 Dec 14, 2023, 4:32 PM CVSSv2 score source (changed from "CVE-2023-5869" to "CVE-2023-39417") CVSSv3 score source (set to "CVE-2023-5869") Plugin Feed: 202312141632
Version 1.3 Dec 14, 2023, 2:28 PM CVSSv2 score source (changed from "CVE-2023-5869" to "CVE-2023-39417") CVSSv3 score source (set to "CVE-2023-5869") Plugin Feed: 202312141428
Version 1.3 Dec 13, 2023, 3:42 AM Plugin metadata Plugin Feed: 202312130342
Version 1.2 Dec 11, 2023, 4:04 PM CVSSv2 score source (changed from "CVE-2023-39417" to "CVE-2023-5869") Plugin Feed: 202312111604
Version 1.1 Dec 11, 2023, 2:00 PM CVSSv2 score source (changed from "CVE-2023-39417" to "CVE-2023-5869") Plugin Feed: 202312111400
Version 1.1 Dec 9, 2023, 11:53 PM Reference Plugin Feed: 202312092353
Version 1.0 Dec 7, 2023, 5:33 PM New Plugin Feed: 202312071733
Version 1.0 Dec 9, 2023, 9:47 PM Reference Plugin Feed: 202312092147