This update for postgresql12 fixes the following issues :

  - Upgrade to version 12.5 :

  - CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ...
    WITH HOLD and firing of deferred triggers within index     expressions and materialized view queries.

  - CVE-2020-25694, bsc#1178667: a) Fix usage of complex     connection-string parameters in pg_dump, pg_restore,     clusterdb, reindexdb, and vacuumdb. b) When psql's     \connect command re-uses connection parameters, ensure     that all non-overridden parameters from a previous     connection string are re-used.

  - CVE-2020-25696, bsc#1178668: Prevent psql's \gset     command from modifying specially-treated variables.

  - Fix recently-added timetz test case so it works when the     USA is not observing daylight savings time.

  - https://www.postgresql.org/about/news/2111/

  - https://www.postgresql.org/docs/12/release-12-5.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Several vulnerabilities have been found in the PostgreSQL database system.

CVE-2020-25694

Peter Eisentraut found that database reconnections may drop options from the original connection, such as encryption, which could lead to information disclosure or a man-in-the-middle attack.

CVE-2020-25695

Etienne Stalmans reported that a user with permissions to create non-temporary objects in an schema can execute arbitrary SQL functions as a superuser.

CVE-2020-25696

Nick Cleaton found that the \gset command modified variables that control the psql behaviour, which could result in a compromised or malicious server executing arbitrary code in the user session.

For Debian 9 stretch, these problems have been fixed in version 9.6.20-0+deb9u1.

We recommend that you upgrade your postgresql-9.6 packages.

For the detailed security status of postgresql-9.6 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-9.6

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202012-07 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly obtain sensitive information, alter SQL       commands, escape PostgreSQL sandbox or execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

This update for postgresql96 fixes the following issues :

Upgrade to version 9.6.20 :

  - CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ...
    WITH HOLD and firing of deferred triggers within index     expressions and materialized view queries.

  - CVE-2020-25694, bsc#1178667: a) Fix usage of complex     connection-string parameters in pg_dump, pg_restore,     clusterdb, reindexdb, and vacuumdb. b) When psql's     \connect command re-uses connection parameters, ensure     that all non-overridden parameters from a previous     connection string are re-used.

  - CVE-2020-25696, bsc#1178668: Prevent psql's \gset     command from modifying specially-treated variables.

  - https://www.postgresql.org/about/news/2111/

  - https://www.postgresql.org/docs/9.6/release-9-6-20.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0017 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-14349:
    It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize     the search_path during logical replication. An authenticated attacker could use this flaw in an attack     similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for     replication.

    CVE-2020-14350:
    It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

    CVE-2020-1720:
    A flaw was found in PostgreSQL's ALTER ... DEPENDS ON EXTENSION, where sub-commands did not perform     authorization checks. An authenticated attacker could use this flaw in certain configurations to perform     drop objects such as function, triggers, et al., leading to database corruption. This issue affects     PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

    CVE-2020-25694:
    A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.

    CVE-2020-25695:
    A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability.

    CVE-2020-25696:
    A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5,     before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset     when querying a compromised server, the attacker can execute arbitrary code as the operating system     account running psql. The highest threat from this vulnerability is to data confidentiality and integrity     as well as system availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5567 advisory.

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5620 advisory.

  - postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

  - postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

  - postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
143343	openSUSE Security Update : postgresql12 (openSUSE-2020-2018)	Nessus	SuSE Local Security Checks	11/30/2020	2/7/2024	high
143461	Debian DLA-2478-1 : postgresql-9.6 security update	Nessus	Debian Local Security Checks	12/3/2020	2/7/2024	high
143503	GLSA-202012-07 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/7/2020	2/6/2024	high
143617	SUSE SLES12 Security Update : postgresql96 (SUSE-SU-2020:3477-1)	Nessus	SuSE Local Security Checks	12/9/2020	5/11/2022	high
236609	Alibaba Cloud Linux 3 : 0017: postgresql:12 (ALINUX3-SA-2021:0017)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
145829	CentOS 8 : postgresql:10 (CESA-2020:5567)	Nessus	CentOS Local Security Checks	2/1/2021	2/8/2023	high
146002	CentOS 8 : postgresql:12 (CESA-2020:5620)	Nessus	CentOS Local Security Checks	2/1/2021	2/8/2023	high
251670	Linux Distros Unpatched Vulnerability : CVE-2020-25695	Nessus	Misc.	8/19/2025	8/19/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high