The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5401 advisory.

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0164 advisory.

  - postgresql: Selectivity estimators bypass row security policies (CVE-2019-10130)

  - postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

  - postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

  - postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0165 advisory.

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0167 advisory.

  - postgresql: Selectivity estimators bypass row security policies (CVE-2019-10130)

  - postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

  - postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

  - postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5619 advisory.

  - postgresql: Selectivity estimators bypass row security policies (CVE-2019-10130)

  - postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

  - postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

  - postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1512 advisory.

  - postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1519 advisory.

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

For more information about the vulnerabilities, refer to the Postgresql News Page.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9290 advisory.

  - A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8,     9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for     tables. Certain statistics, such as histograms and lists of most common values, contain values taken from     the column. PostgreSQL does not evaluate row security policies before consulting those statistics during     query planning; an attacker can exploit this to read the most common values of certain columns. Affected     columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-     level security prunes the set of rows visible to the attacker. (CVE-2019-10130)

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize     the search_path during logical replication. An authenticated attacker could use this flaw in an attack     similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for     replication. (CVE-2020-14349)

  - PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer     overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to     a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system     account. (CVE-2019-10164)

  - A flaw was found in PostgreSQL's ALTER ... DEPENDS ON EXTENSION, where sub-commands did not perform     authorization checks. An authenticated attacker could use this flaw in certain configurations to perform     drop objects such as function, triggers, et al., leading to database corruption. This issue affects     PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17. (CVE-2020-1720)

  - It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5,     before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset     when querying a compromised server, the attacker can execute arbitrary code as the operating system     account running psql. The highest threat from this vulnerability is to data confidentiality and integrity     as well as system availability. (CVE-2020-25696)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

  - A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a     partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration,     any user can create a partitioned table suitable for this attack. (Exploit prerequisites are the same as     for CVE-2018-1052). (CVE-2019-10129)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has postgresql packages installed that are affected by multiple vulnerabilities:

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the postgresql packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
144204	RHEL 8 : libpq (RHSA-2020:5401)	Nessus	Red Hat Local Security Checks	12/14/2020	5/25/2023	high
145043	RHEL 8 : postgresql:9.6 (RHSA-2021:0164)	Nessus	Red Hat Local Security Checks	1/18/2021	5/24/2023	high
145226	RHEL 8 : libpq (RHSA-2021:0165)	Nessus	Red Hat Local Security Checks	1/20/2021	5/24/2023	high
145227	RHEL 8 : postgresql:9.6 (RHSA-2021:0167)	Nessus	Red Hat Local Security Checks	1/20/2021	5/24/2023	high
146009	CentOS 8 : postgresql:9.6 (CESA-2020:5619)	Nessus	CentOS Local Security Checks	2/1/2021	2/8/2023	high
150771	CentOS 7 : postgresql (CESA-2021:1512)	Nessus	CentOS Local Security Checks	6/14/2021	5/9/2022	high
151513	Amazon Linux AMI : postgresql92 (ALAS-2021-1519)	Nessus	Amazon Linux Local Security Checks	7/13/2021	5/9/2022	high
184137	Puppet Enterprise < 2018.1.18 / 2019.x < 2019.8.4 PostgreSQL Vulnerabilities	Nessus	Misc.	11/1/2023	11/2/2023	high
150722	Oracle Linux 7 : rh-postgresql10-postgresql (ELSA-2021-9290)	Nessus	Oracle Linux Local Security Checks	6/11/2021	12/13/2023	high
160799	NewStart CGSL CORE 5.05 / MAIN 5.05 : postgresql Multiple Vulnerabilities (NS-SA-2022-0038)	Nessus	NewStart CGSL Local Security Checks	5/9/2022	5/9/2022	high
165886	EulerOS Virtualization 3.0.6.6 : postgresql (EulerOS-SA-2022-2528)	Nessus	Huawei Local Security Checks	10/9/2022	2/16/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high