The version of PostgreSQL installed on the remote host is 9.5 prior to 9.5.24, 9.6 prior to 9.6.20, 10 prior to 10.15, 11 prior to 11.10, 12 prior to 12.5, or 13 prior to 13.1. As such, it is potentially affected by multiple vulnerabilities :
  - Multiple features escape security restricted operation sandbox (CVE-2020-25695)
  - Reconnection can downgrade connection security settings (CVE-2020-25694)
  - psql's gset allows overwriting specially treated variables (CVE-2020-25696) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-56191 advisory.

  - A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8,     9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for     tables. Certain statistics, such as histograms and lists of most common values, contain values taken from     the column. PostgreSQL does not evaluate row security policies before consulting those statistics during     query planning; an attacker can exploit this to read the most common values of certain columns. Affected     columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-     level security prunes the set of rows visible to the attacker. (CVE-2019-10130)

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - A flaw was found in PostgreSQL's ALTER ... DEPENDS ON EXTENSION, where sub-commands did not perform     authorization checks. An authenticated attacker could use this flaw in certain configurations to perform     drop objects such as function, triggers, et al., leading to database corruption. This issue affects     PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17. (CVE-2020-1720)

  - It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5,     before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset     when querying a compromised server, the attacker can execute arbitrary code as the operating system     account running psql. The highest threat from this vulnerability is to data confidentiality and integrity     as well as system availability. (CVE-2020-25696)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has postgresql packages installed that are affected by multiple vulnerabilities:

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5317 advisory.

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql10 fixes the following issues :

  - Upgrade to version 10.15 :

  - CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ...
    WITH HOLD and firing of deferred triggers within index     expressions and materialized view queries.

  - CVE-2020-25694, bsc#1178667: a) Fix usage of complex     connection-string parameters in pg_dump, pg_restore,     clusterdb, reindexdb, and vacuumdb. b) When psql's     \connect command re-uses connection parameters, ensure     that all non-overridden parameters from a previous     connection string are re-used.

  - CVE-2020-25696, bsc#1178668: Prevent psql's \gset     command from modifying specially-treated variables.

  - Fix recently-added timetz test case so it works when the     USA is not observing daylight savings time.

  - https://www.postgresql.org/about/news/2111/

  - https://www.postgresql.org/docs/10/release-10-15.html

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1512 advisory.

  - postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5664 advisory.

  - postgresql: Selectivity estimators bypass row security policies (CVE-2019-10130)

  - postgresql: Stack-based buffer overflow via setting a password (CVE-2019-10164)

  - postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution (CVE-2019-10208)

  - postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks (CVE-2020-1720)

  - postgresql: Uncontrolled search path element in logical replication (CVE-2020-14349)

  - postgresql: Uncontrolled search path element in CREATE EXTENSION (CVE-2020-14350)

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server     crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression     within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the     equality operator used for a CASE expression involving values of different types. (CVE-2016-5423)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser     privileges via a (1)  (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in     a (a) database or (b) role name that is mishandled during an administrative operation. (CVE-2016-5424)

  - PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before     9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers     have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for     starting the database server during system boot. Packages of PostgreSQL for many operating systems provide     their own, packager-authored startup implementations. Several implementations use a log file name that the     database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log     file name. This often suffices for the database superuser to escalate to root privileges when root starts     the server. (CVE-2017-12172)

  - Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker     with access to the postgres user account could use these flaws to obtain root access on the server     machine. (CVE-2017-15097)

  - It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17,     9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use     this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

  - PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses     foreign server passwords to any user having USAGE privilege on the associated foreign server.
    (CVE-2017-7486)

  - A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.
    An attacker with a user account could use this flaw to execute code with the permissions of superuser in     the database. Versions 9.3 through 10 are affected. (CVE-2018-1058)

  - A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory     and not check the host name if a host name verifier was not provided to the driver. This could lead to a     condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a     certificate for the wrong host, as long as it was signed by a trusted CA. (CVE-2018-10936)

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

  - An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly     sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP     signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user     with sufficient privileges at the OS level (the postgres account or the root account). (CVE-2020-21469)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

  - A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on     one column to craft a special query that returns all columns of the table. The highest threat from this     vulnerability is to confidentiality. (CVE-2021-20229)

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

  - A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an     authenticated database user could read arbitrary bytes of server memory. The highest threat from this     vulnerability is to data confidentiality. (CVE-2021-32029)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

  - A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects     in at least one schema, the ability to lure or wait for an administrator to create or update an affected     extension in that schema, and the ability to lure or wait for a victim to use the object targeted in     CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to     run arbitrary code as the victim role, which may be a superuser. (CVE-2022-2625)

  - In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes. (CVE-2022-41862)

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

  - A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack. (CVE-2023-5870)

  - Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the     owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a     superuser or member of one of the attacker's roles. The attack requires luring the victim into running     REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this     vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built     temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only     known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the     protections that older branches are using to fix their vulnerability. (CVE-2024-0985)

  - Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table ownermore details     (CVE-2024-4317)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
144060	PostgreSQL 9.5.x < 9.5.24 / 9.6.x < 9.6.20 / 10.x < 10.15 / 11.x < 11.10 / 12.x < 12.5 / 13.x < 13.1 Multiple Vulnerabilities	Nessus	Databases	12/10/2020	4/4/2023	high
144565	Oracle Linux 8 : ELSA-2020-5619-1: / postgresql:9.6 (ELSA-2020-56191)	Nessus	Oracle Linux Local Security Checks	12/23/2020	5/11/2022	high
154465	NewStart CGSL CORE 5.04 / MAIN 5.04 : postgresql Multiple Vulnerabilities (NS-SA-2021-0109)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	5/9/2022	high
170338	RHEL 7 : rh-postgresql12-postgresql (RHSA-2020:5317)	Nessus	Red Hat Local Security Checks	1/23/2023	5/25/2023	high
143338	openSUSE Security Update : postgresql10 (openSUSE-2020-2019)	Nessus	SuSE Local Security Checks	11/30/2020	2/7/2024	high
149321	RHEL 7 : postgresql (RHSA-2021:1512)	Nessus	Red Hat Local Security Checks	5/6/2021	4/28/2024	high
144559	RHEL 8 : postgresql:10 (RHSA-2020:5664)	Nessus	Red Hat Local Security Checks	12/22/2020	4/28/2024	high
195391	RHEL 6 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high