The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2390 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (10.17)

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2394 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql12-postgresql (12.7).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    * postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

    * postgresql: Partition constraint violation errors leak values of denied columns (CVE-2021-3393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2396 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql13-postgresql (13.3).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    * postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2372 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (12.7)

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    * postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

    * postgresql: Partition constraint violation errors leak values of denied columns (CVE-2021-3393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1970-1 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2777-1 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:2360 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5645-1 advisory.

    Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption.
    A remote attacker could possibly use this issue to inject arbitrary SQL queries when a connection is first     established. (CVE-2021-23214)

    Tom Lane discovered that PostgreSQL incorrect handled certain array subscripting calculations. An     authenticated attacker could possibly use this issue to overwrite server memory and escalate privileges.
    (CVE-2021-32027)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2389 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (12.7)

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    * postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

    * postgresql: Partition constraint violation errors leak values of denied columns (CVE-2021-3393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2375 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (13.3).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    * postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2361 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (10.17).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

    * postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2375 advisory.

  - postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

  - postgresql: Memory disclosure in partitioned-table UPDATE ... RETURNING (CVE-2021-32029)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - PostgreSQL is an advanced Object-Relational database     management system (DBMS). The base postgresql package     contains the client programs that you'll need to access     a PostgreSQL DBMS server, as well as HTML documentation     for the whole system. These client programs can be     located on the same machine as the PostgreSQL server,     or on a remote machine that accesses a PostgreSQL     server over a network connection. The PostgreSQL server     can be found in the postgresql-server     sub-package.Security Fix(es):A flaw was found in     postgresql in versions before 13.3, before 12.7, before     11.12, before 10.17 and before 9.6.22. While modifying     certain SQL array values, missing bounds checks let     authenticated database users write arbitrary bytes to a     wide area of server memory. The highest threat from     this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2021-32027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0043 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-32027:
    A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability.

    CVE-2021-32028:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

    CVE-2021-32029:
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
150758	RHEL 8 : postgresql:10 (RHSA-2021:2390)	Nessus	Red Hat Local Security Checks	6/14/2021	11/7/2024	high
150790	RHEL 7 : rh-postgresql12-postgresql (RHSA-2021:2394)	Nessus	Red Hat Local Security Checks	6/15/2021	11/7/2024	high
150792	RHEL 7 : rh-postgresql13-postgresql (RHSA-2021:2396)	Nessus	Red Hat Local Security Checks	6/15/2021	11/7/2024	high
150815	RHEL 8 : postgresql:12 (RHSA-2021:2372)	Nessus	Red Hat Local Security Checks	6/16/2021	11/8/2024	high
151731	openSUSE 15 Security Update : postgresql10 (openSUSE-SU-2021:1970-1)	Nessus	SuSE Local Security Checks	7/16/2021	8/19/2021	high
152691	SUSE SLES15 Security Update : postgresql10 (SUSE-SU-2021:2777-1)	Nessus	SuSE Local Security Checks	8/20/2021	7/13/2023	high
157835	Rocky Linux 8 : postgresql:9.6 (RLSA-2021:2360)	Nessus	Rocky Linux Local Security Checks	2/9/2022	11/7/2023	high
165526	Ubuntu 16.04 ESM : PostgreSQL vulnerabilities (USN-5645-1)	Nessus	Ubuntu Local Security Checks	9/28/2022	8/27/2024	high
150759	RHEL 8 : postgresql:12 (RHSA-2021:2389)	Nessus	Red Hat Local Security Checks	6/14/2021	11/7/2024	high
150816	RHEL 8 : postgresql:13 (RHSA-2021:2375)	Nessus	Red Hat Local Security Checks	6/16/2021	11/7/2024	high
150817	RHEL 8 : postgresql:10 (RHSA-2021:2361)	Nessus	Red Hat Local Security Checks	6/16/2021	11/7/2024	high
150834	CentOS 8 : postgresql:13 (CESA-2021:2375)	Nessus	CentOS Local Security Checks	6/16/2021	8/19/2021	high
152399	EulerOS 2.0 SP8 : postgresql (EulerOS-SA-2021-2312)	Nessus	Huawei Local Security Checks	8/10/2021	12/4/2023	high
236568	Alibaba Cloud Linux 3 : 0043: postgresql:13 (ALINUX3-SA-2021:0043)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high

high