The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0161 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (10.15).

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0163 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (12.5).

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

    * postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

    * postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    * postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4633-1 advisory.

    Peter Eisentraut discovered that PostgreSQL incorrectly handled connection security settings. Client     applications could possibly be connecting with certain security parameters dropped, contrary to     expectations. (CVE-2020-25694)

    Etienne Stalmans discovered that PostgreSQL incorrectly handled the security restricted operation sandbox.
    An authenticated remote attacker could possibly use this issue to execute arbitrary SQL functions as a     superuser. (CVE-2020-25695)

    Nick Cleaton discovered that PostgreSQL incorrectly handled the \gset meta-command. A remote attacker with     a compromised server could possibly use this issue to execute arbitrary code. (CVE-2020-25696)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql12 fixes the following issues :

  - Upgrade to version 12.5 :

  - CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ...
    WITH HOLD and firing of deferred triggers within index     expressions and materialized view queries.

  - CVE-2020-25694, bsc#1178667: a) Fix usage of complex     connection-string parameters in pg_dump, pg_restore,     clusterdb, reindexdb, and vacuumdb. b) When psql's     \connect command re-uses connection parameters, ensure     that all non-overridden parameters from a previous     connection string are re-used.

  - CVE-2020-25696, bsc#1178668: Prevent psql's \gset     command from modifying specially-treated variables.

  - Fix recently-added timetz test case so it works when the     USA is not observing daylight savings time.

  - https://www.postgresql.org/about/news/2111/

  - https://www.postgresql.org/docs/12/release-12-5.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for postgresql10 fixes the following issues :

  - Upgrade to version 10.15 :

  - CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ...
    WITH HOLD and firing of deferred triggers within index     expressions and materialized view queries.

  - CVE-2020-25694, bsc#1178667: a) Fix usage of complex     connection-string parameters in pg_dump, pg_restore,     clusterdb, reindexdb, and vacuumdb. b) When psql's     \connect command re-uses connection parameters, ensure     that all non-overridden parameters from a previous     connection string are re-used.

  - CVE-2020-25696, bsc#1178668: Prevent psql's \gset     command from modifying specially-treated variables.

  - Fix recently-added timetz test case so it works when the     USA is not observing daylight savings time.

  - https://www.postgresql.org/about/news/2111/

  - https://www.postgresql.org/docs/10/release-10-15.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

An update of the postgresql package has been released.

This update for postgresql12 fixes the following issues :

Upgrade to version 12.5 :

CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries.

CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb.
b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used.

CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables.

Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch)

https://www.postgresql.org/about/news/2111/

https://www.postgresql.org/docs/12/release-12-5.html

The previous postgresql12 update already addressed :

Update to 12.4 :

CVE-2020-14349, bsc#1175193: Set a secure search_path in logical replication walsenders and apply workers

CVE-2020-14350, bsc#1175194: Make contrib modules' installation scripts more secure.

https://www.postgresql.org/docs/12/release-12-4.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql10 fixes the following issues :

Upgrade to version 10.15 :

  - CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ...
    WITH HOLD and firing of deferred triggers within index     expressions and materialized view queries.

  - CVE-2020-25694, bsc#1178667: a) Fix usage of complex     connection-string parameters in pg_dump, pg_restore,     clusterdb, reindexdb, and vacuumdb. b) When psql's     \connect command re-uses connection parameters, ensure     that all non-overridden parameters from a previous     connection string are re-used.

  - CVE-2020-25696, bsc#1178668: Prevent psql's \gset     command from modifying specially-treated variables.

  - Fix recently-added timetz test case so it works when the     USA is not observing daylight savings time.

  - https://www.postgresql.org/about/news/2111/

  - https://www.postgresql.org/docs/10/release-10-15.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5567 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (10.15).

    Security Fix(es):

    * postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

    * postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

    * postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-55671 advisory.

    [10.15-1]
    - Rebase to upstream release 10.15       Resolves: rhbz#1898213       Resolves: rhbz#1898341       Resolves: rhbz#1901567

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-56201 advisory.

    postgresql     [12.5-1]
    - Rebase to upstream release 12.5       Resolves: rhbz#1901555       Resolves: rhbz#1898223       Resolves: rhbz#1898329

    [12.1-3]
    - Release bump for 8.2.0 BZ#1776805

    [12.1-2]
    - Release bump for rebuild against libpq-12.1-3

    [12.1-1]
    - Rebase to upstream release 12.1

    [12.0-1]
    - Rebase to upstream release 12.0

    [12.0-0.3]
    - Rebase to upstream beta release 12beta4
    - postgresql-server-devel requires krb5-devel

    [12.0-0.2]
    - Rebase to upstream beta release 12beta3

    [12.0-0.1]
    - Rebase to upstream beta release 12beta2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql, postgresql13 fixes the following issues :

This update ships postgresql13.

Upgrade to version 13.1 :

CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries.

CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb.
b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used.

CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables.

Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch)

https://www.postgresql.org/about/news/2111/

https://www.postgresql.org/docs/13/release-13-1.html

Initial packaging of PostgreSQL 13 :

https://www.postgresql.org/about/news/2077/

https://www.postgresql.org/docs/13/release-13.html

bsc#1178961: %ghost the symlinks to pg_config and ecpg.

Changes in postgresql wrapper package :

Bump major version to 13.

We also transfer PostgreSQL 9.4.26 to the new package layout in SLE12-SP2 and newer. Reflect this in the conflict with postgresql94.

Also conflict with PostgreSQL versions before 9.

Conflicting with older versions is not limited to SLE.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql, postgresql12, postgresql13 fixes the following issues :

Initial packaging of PostgreSQL 13 :

https://www.postgresql.org/about/news/2077/

https://www.postgresql.org/docs/13/release-13.html

Changes in postgresql :

Bump postgresql major version to 13.

Changes in postgresql12 :

%ghost the symlinks to pg_config and ecpg. (bsc#1178961)

BuildRequire libpq5 and libecpg6 when not building them to avoid dangling symlinks in the devel package. (bsc#1179765)

Fix a DST problem in the test suite.

Changes in postgresql13 :

Add postgresql-icu68.patch: fix build with ICU 68

%ghost the symlinks to pg_config and ecpg. (bsc#1178961)

BuildRequire libpq5 and libecpg6 when not building them to avoid dangling symlinks in the devel package. (bsc#1179765)

Upgrade to version 13.1 :

CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries.

CVE-2020-25694, bsc#1178667: a) Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb.
b) When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used.

CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from modifying specially-treated variables.

Fix recently-added timetz test case so it works when the USA is not observing daylight savings time. (obsoletes postgresql-timetz.patch)

https://www.postgresql.org/about/news/2111/

https://www.postgresql.org/docs/13/release-13-1.html

Fix a DST problem in the test suite.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
145042	RHEL 8 : postgresql:10 (RHSA-2021:0161)	Nessus	Red Hat Local Security Checks	1/18/2021	11/7/2024	high
145044	RHEL 8 : postgresql:12 (RHSA-2021:0163)	Nessus	Red Hat Local Security Checks	1/18/2021	11/8/2024	high
142968	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : PostgreSQL vulnerabilities (USN-4633-1)	Nessus	Ubuntu Local Security Checks	11/17/2020	8/29/2024	high
143290	openSUSE Security Update : postgresql12 (openSUSE-2020-2029)	Nessus	SuSE Local Security Checks	11/30/2020	2/8/2024	high
143320	openSUSE Security Update : postgresql10 (openSUSE-2020-2028)	Nessus	SuSE Local Security Checks	11/30/2020	2/7/2024	high
143363	Photon OS 1.0: Postgresql PHSA-2020-1.0-0340	Nessus	PhotonOS Local Security Checks	11/30/2020	7/22/2024	high
143653	SUSE SLES12 Security Update : postgresql12 (SUSE-SU-2020:3630-1)	Nessus	SuSE Local Security Checks	12/9/2020	5/11/2022	high
143846	SUSE SLES15 Security Update : postgresql10 (SUSE-SU-2020:3455-1)	Nessus	SuSE Local Security Checks	12/9/2020	5/11/2022	high
144401	RHEL 8 : postgresql:10 (RHSA-2020:5567)	Nessus	Red Hat Local Security Checks	12/18/2020	11/7/2024	high
144561	Oracle Linux 8 : ELSA-2020-5567-1: / postgresql:10 (ELSA-2020-55671)	Nessus	Oracle Linux Local Security Checks	12/23/2020	10/22/2024	high
144564	Oracle Linux 8 : ELSA-2020-5620-1: / postgresql:12 (ELSA-2020-56201)	Nessus	Oracle Linux Local Security Checks	12/23/2020	11/1/2024	high
145239	SUSE SLED15 / SLES15 Security Update : postgresql, postgresql13 (SUSE-SU-2021:0175-1)	Nessus	SuSE Local Security Checks	1/21/2021	5/11/2022	high
145490	SUSE SLES12 Security Update : postgresql, postgresql12, postgresql13 (SUSE-SU-2021:0217-1)	Nessus	SuSE Local Security Checks	1/27/2021	5/11/2022	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high