The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4058-1 advisory.

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5179 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql13-postgresql (13.5).

    Security Fix(es):

    * postgresql: memory disclosure in certain queries (CVE-2021-3677)

    * postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

    * postgresql: libpq processes unencrypted bytes from man-in-the-middle (CVE-2021-23222)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2958-1 advisory.

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

  - A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an     authenticated database user could read arbitrary bytes of server memory. The highest threat from this     vulnerability is to data confidentiality. (CVE-2021-32029)

  - A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the     default configuration, any authenticated database user can complete this attack at will. The attack does     not require the ability to create objects. If server settings include max_worker_processes=0, the known     versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of     that setting. (CVE-2021-3677)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

  - A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects     in at least one schema, the ability to lure or wait for an administrator to create or update an affected     extension in that schema, and the ability to lure or wait for a victim to use the object targeted in     CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to     run arbitrary code as the victim role, which may be a superuser. (CVE-2022-2625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202211-04 (PostgreSQL: Multiple Vulnerabilities)

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

  - A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the     default configuration, any authenticated database user can complete this attack at will. The attack does     not require the ability to create objects. If server settings include max_worker_processes=0, the known     versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of     that setting. (CVE-2021-3677)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

  - A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects     in at least one schema, the ability to lure or wait for an administrator to create or update an affected     extension in that schema, and the ability to lure or wait for a victim to use the object targeted in     CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to     run arbitrary code as the victim role, which may be a superuser. (CVE-2022-2625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端 Rocky Linux 8 主機已安裝受到 RLSA-2022:1891 公告中所提及一個弱點影響的套件。

  - 儘管使用 SSL 憑證驗證和加密，攔截式攻擊者仍可將錯誤的回應注入用戶端的前幾個查詢。(CVE-2021-23222)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 postgresql 版本為早於 14.1-3 的版本。因此，它受到 ALAS2POSTGRESQL14-2024-008 公告中提及的一個弱點影響。

  - 儘管使用 SSL 憑證驗證和加密，攔截式攻擊者仍可將錯誤的回應注入用戶端的前幾個查詢。(CVE-2021-23222)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 10 主機上安裝的多個套件受到 dsa-5006 公告中提及的多個弱點影響。

  - 儘管使用 SSL 憑證驗證和加密，攔截式攻擊者仍可將錯誤的回應注入用戶端的前幾個查詢。(CVE-2021-23222)

  - 當伺服器設定為使用含 clientcert 要求的信任驗證或使用 cert 驗證，則即使使用 TLS 憑證驗證和加密，攔截式攻擊者仍可在首次建立連線時注入任意 SQL 查詢。(CVE-2021-23214)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 9 主機上安裝的多個套件受到 dla-2817 公告中提及的多個弱點影響。

  - 儘管使用 SSL 憑證驗證和加密，攔截式攻擊者仍可將錯誤的回應注入用戶端的前幾個查詢。(CVE-2021-23222)

  - 當伺服器設定為使用含 clientcert 要求的信任驗證或使用 cert 驗證，則即使使用 TLS 憑證驗證和加密，攔截式攻擊者仍可在首次建立連線時注入任意 SQL 查詢。(CVE-2021-23214)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 7 主機上安裝的套件受到 RHSA-2021：5197 公告中提及的一個弱點影響。

  - postgresql：伺服器處理來自中間人的未加密位元組 (CVE-2021-23214)

  - postgresql：libpq 處理來自中間人的未加密位元組 (CVE-2021-23222)

  - postgresql：特定查詢中出現記憶體洩漏 (CVE-2021-3677)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 11 主機上安裝的多個套件受到 dsa-5007 公告中提及的多個弱點影響。

  - 當伺服器設定為使用含 clientcert 要求的信任驗證或使用 cert 驗證，則即使使用 TLS 憑證驗證和加密，攔截式攻擊者仍可在首次建立連線時注入任意 SQL 查詢。(CVE-2021-23214)

  - 儘管使用 SSL 憑證驗證和加密，攔截式攻擊者仍可將錯誤的回應注入用戶端的前幾個查詢。(CVE-2021-23222)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 postgresql 版本為早於 12.11-3 的版本。因此，會受到 ALAS2POSTGRESQL12-2023-002 公告中所提及的多個弱點影響。

    2024-08-28：已將 CVE-2021-3677 新增至此公告。

    2024-02-29：已將 CVE-2021-23222 新增至此公告。

    儘管使用 SSL 憑證驗證和加密，攔截式攻擊者仍可將錯誤的回應注入用戶端的前幾個查詢。(CVE-2021-23222)

    在 postgresql 中發現一個缺陷。可以透過特製的查詢讀取伺服器記憶體的任意位元組。在預設組態中，任何經驗證的資料庫使用者皆可任意完成此攻擊。發動此攻擊不需要具備建立物件的能力。如果伺服器設定包含 max_worker_processes=0，則此攻擊的已知版本並不可行。但是，未發現的攻擊變體可能與該設定無關。(CVE-2021-3677)

    在 PostgreSQL 中發現一個缺陷。當有權限的使用者維護其他使用者的物件時，會發生安全作業不完整的問題。在處理程序期間，Autovacuum、REINDEX、CREATE INDEX、REFRESH MATERIALIZED VIEW、CLUSTER 和 pg_amcheck 命令啟動相關保護措施過晚或完全不啟動。如果攻擊者有權在至少一個結構描述中建立非暫存物件，便能以超級使用者的身分執行任意 SQL 函式。(CVE-2022-1552)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 postgresql 版本為早於 13.7-2 的版本。因此，會受到 ALAS2POSTGRESQL13-2023-002 公告中所提及的多個弱點影響。

    2024-08-28：已將 CVE-2021-3677 新增至此公告。

    2024-02-29：已將 CVE-2021-23222 新增至此公告。

    儘管使用 SSL 憑證驗證和加密，攔截式攻擊者仍可將錯誤的回應注入用戶端的前幾個查詢。(CVE-2021-23222)

    在 postgresql 中發現一個缺陷。可以透過特製的查詢讀取伺服器記憶體的任意位元組。在預設組態中，任何經驗證的資料庫使用者皆可任意完成此攻擊。發動此攻擊不需要具備建立物件的能力。如果伺服器設定包含 max_worker_processes=0，則此攻擊的已知版本並不可行。但是，未發現的攻擊變體可能與該設定無關。(CVE-2021-3677)

    在 PostgreSQL 中發現一個缺陷。當有權限的使用者維護其他使用者的物件時，會發生安全作業不完整的問題。在處理程序期間，Autovacuum、REINDEX、CREATE INDEX、REFRESH MATERIALIZED VIEW、CLUSTER 和 pg_amcheck 命令啟動相關保護措施過晚或完全不啟動。如果攻擊者有權在至少一個結構描述中建立非暫存物件，便能以超級使用者的身分執行任意 SQL 函式。(CVE-2022-1552)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	Name	Product	Family	Published	Updated	Severity
156093	SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2021:4058-1)	Nessus	SuSE Local Security Checks	12/15/2021	7/13/2023	high
156126	RHEL 7 : rh-postgresql13-postgresql (RHSA-2021:5179)	Nessus	Red Hat Local Security Checks	12/16/2021	11/7/2024	high
164542	SUSE SLES15 Security Update : postgresql12 (SUSE-SU-2022:2958-1)	Nessus	SuSE Local Security Checks	9/1/2022	7/14/2023	high
168040	GLSA-202211-04 : PostgreSQL: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	11/22/2022	11/22/2022	high
184775	Rocky Linux 8libpq (RLSA-2022:1891)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	medium
191610	Amazon Linux 2：postgresql (ALASPOSTGRESQL14-2024-008)	Nessus	Amazon Linux Local Security Checks	3/6/2024	12/11/2024	medium
155311	Debian DSA-5006-1：postgresql-11 - 安全性更新	Nessus	Debian Local Security Checks	11/12/2021	1/24/2025	high
155312	Debian DLA-2817-1：postgresql-9.6 - LTS 安全性更新	Nessus	Debian Local Security Checks	11/12/2021	1/24/2025	high
156128	RHEL 7：rh-postgresql12-postgresql (RHSA-2021: 5197)	Nessus	Red Hat Local Security Checks	12/16/2021	11/7/2024	high
176381	Debian DSA-5007-1：postgresql-13 - 安全性更新	Nessus	Debian Local Security Checks	5/25/2023	1/24/2025	high
182052	Amazon Linux 2：postgresql (ALASPOSTGRESQL12-2023-002)	Nessus	Amazon Linux Local Security Checks	9/27/2023	12/11/2024	high
182064	Amazon Linux 2：postgresql (ALASPOSTGRESQL13-2023-002)	Nessus	Amazon Linux Local Security Checks	9/27/2023	12/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

medium

medium

high

high

high

high

high

high