postgresql10用のこの更新は次の問題を修正します：

修正されたセキュリティ問題：

CVE-2019-10164：SCRAM検証機能解析でのバッファオーバーフローの脆弱性を修正しました（bsc#1138034）。

CVE-2019-10130：行レベルのセキュリティポリシーが選択度推定子によってバイパスされないようにします（bsc#1134689）。

バグ修正：修正の完全なリストについては、リリースノートを確認してください。

    -https://www.postgresql.org/docs/10/release-10-9.html

    -https://www.postgresql.org/docs/10/release-10-8.html

    -https://www.postgresql.org/docs/10/release-10-7.html

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

リモートの Redhat Enterprise Linux 7 ホストにインストールされているパッケージは、RHSA-2020: 0980アドバイザリに記載されている複数の脆弱性の影響を受けます。

  - postgresql: 選択性推定ツールが行セキュリティポリシーをバイパスする（CVE-2019-10130）

  - postgresql：パスワード設定によるスタックベースのバッファオーバーフロー（CVE-2019-10164）

  - postgresql：pg_tempのTYPEが、SECURITY DEFINERの実行中に任意のSQLを実行します（CVE-2019-10208）

  - postgresql: ALTER ... DEPENDS ON EXTENSIONに認証チェックがありません（CVE-2020-1720）

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

This update for postgresql10 fixes the following issues :

Security issue fixed :

CVE-2019-10164: Fixed buffer-overflow vulnerabilities in SCRAM verifier parsing (bsc#1138034).

CVE-2019-10130: Prevent row-level security policies from being bypassed via selectivity estimators (bsc#1134689).

Bug fixes: For a complete list of fixes check the release notes.

    - https://www.postgresql.org/docs/10/release-10-9.html

    - https://www.postgresql.org/docs/10/release-10-8.html

    - https://www.postgresql.org/docs/10/release-10-7.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql10 to version 10.9 fixes the following issue :

Security issue fixed :

CVE-2019-10164: Fixed buffer-overflow vulnerabilities in SCRAM verifier parsing (bsc#1138034).

More information at https://www.postgresql.org/docs/10/release-10-9.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the postgresql package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3669 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (10.14).

    Security Fix(es):

    * postgresql: Stack-based buffer overflow via setting a password (CVE-2019-10164)

    * postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

    * postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

    * postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

    * postgresql: Selectivity estimators bypass row security policies (CVE-2019-10130)

    * postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Module stream postgresql:10 does not have correct module.md file (BZ#1857228)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3669 advisory.

    [10.14-1]
    - Rebase to upstream release 10.14       Fixes RHBZ#1727803       Fixes RHBZ#1741489       Fixes RHBZ#1709196

    [10.13-1]
    - Rebase to upstream release 10.13       Fixes RHBZ#1727803       Fixes RHBZ#1741489       Fixes RHBZ#1709196

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0166 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (10.15).

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

    * postgresql: Stack-based buffer overflow via setting a password (CVE-2019-10164)

    * postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

    * postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

    * postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    * postgresql: Selectivity estimators bypass row security policies (CVE-2019-10130)

    * postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0980 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql10-postgresql (10.12).

    Security Fix(es):

    * PostgreSQL: stack-based buffer overflow via setting a password (CVE-2019-10164)

    * PostgreSQL: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
126618	SUSE SLED15 / SLES15セキュリティ更新プログラム：postgresql10（SUSE-SU-2019:1810-1）	Nessus	SuSE Local Security Checks	7/11/2019	5/10/2024	high
127752	SUSE SLED15 / SLES15セキュリティ更新プログラム：postgresql10（SUSE-SU-2019:2012-1）	Nessus	SuSE Local Security Checks	8/12/2019	5/6/2024	high
170334	RHEL 7: rh-postgresql10-postgresql (RHSA-2020: 0980)	Nessus	Red Hat Local Security Checks	1/23/2023	11/7/2024	high
127752	SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2019:2012-1)	Nessus	SuSE Local Security Checks	8/12/2019	5/6/2024	high
126595	SUSE SLED12 / SLES12 Security Update : postgresql10 (SUSE-SU-2019:1783-1)	Nessus	SuSE Local Security Checks	7/10/2019	5/10/2024	high
126618	SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2019:1810-1)	Nessus	SuSE Local Security Checks	7/11/2019	5/10/2024	high
126955	Photon OS 1.0: Postgresql PHSA-2019-1.0-0243	Nessus	PhotonOS Local Security Checks	7/24/2019	1/3/2020	high
140398	RHEL 8 : postgresql:10 (RHSA-2020:3669)	Nessus	Red Hat Local Security Checks	9/8/2020	3/15/2025	high
140486	Oracle Linux 8 : postgresql:10 (ELSA-2020-3669)	Nessus	Oracle Linux Local Security Checks	9/10/2020	10/22/2024	high
145243	RHEL 8 : postgresql:10 (RHSA-2021:0166)	Nessus	Red Hat Local Security Checks	1/21/2021	11/7/2024	high
170334	RHEL 7 : rh-postgresql10-postgresql (RHSA-2020:0980)	Nessus	Red Hat Local Security Checks	1/23/2023	11/7/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high