According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Privilege escalation flaws were found in the     initialization scripts of PostgreSQL. An attacker with     access to the postgres user account could use these     flaws to obtain root access on the server machine.
    (CVE-2017-12172, CVE-2017-15097)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3402 advisory.

  - postgresql: Start scripts permit database administrator to modify root-owned files (CVE-2017-12172,     CVE-2017-15097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: Improper randomization of pgcrypto functions (requiring random seed) (CVE-2013-1900)

  - postgresql: Empty password accepted in some authentication methods (CVE-2017-7546)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server     crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression     within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the     equality operator used for a CASE expression involving values of different types. (CVE-2016-5423)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser     privileges via a (1)  (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in     a (a) database or (b) role name that is mishandled during an administrative operation. (CVE-2016-5424)

  - PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before     9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers     have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for     starting the database server during system boot. Packages of PostgreSQL for many operating systems provide     their own, packager-authored startup implementations. Several implementations use a log file name that the     database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log     file name. This often suffices for the database superuser to escalate to root privileges when root starts     the server. (CVE-2017-12172)

  - Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker     with access to the postgres user account could use these flaws to obtain root access on the server     machine. (CVE-2017-15097)

  - It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17,     9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use     this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

  - PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses     foreign server passwords to any user having USAGE privilege on the associated foreign server.
    (CVE-2017-7486)

  - A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.
    An attacker with a user account could use this flaw to execute code with the permissions of superuser in     the database. Versions 9.3 through 10 are affected. (CVE-2018-1058)

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

  - A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5,     before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset     when querying a compromised server, the attacker can execute arbitrary code as the operating system     account running psql. The highest threat from this vulnerability is to data confidentiality and integrity     as well as system availability. (CVE-2020-25696)

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

An update for postgresql is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es) :

* Privilege escalation flaws were found in the initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.
(CVE-2017-12172, CVE-2017-15097)

Note: This patch drops the script privileges from root to the postgres user. Therefore, this update works properly only if the postgres user has write access to the postgres' home directory, such as the one in the default configuration (/var/lib/pgsql).

Red Hat would like to thank the PostgreSQL project for reporting CVE-2017-12172. The CVE-2017-15097 issue was discovered by Pedro Barbosa (Red Hat) and the PostgreSQL project. Upstream acknowledges Antoine Scemama (Brainloop) as the original reporter of these issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3405 advisory.

  - postgresql: Start scripts permit database administrator to modify root-owned files (CVE-2017-12172,     CVE-2017-15097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server     crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression     within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the     equality operator used for a CASE expression involving values of different types. (CVE-2016-5423)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser     privileges via a (1)  (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in     a (a) database or (b) role name that is mishandled during an administrative operation. (CVE-2016-5424)

  - PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before     9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers     have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for     starting the database server during system boot. Packages of PostgreSQL for many operating systems provide     their own, packager-authored startup implementations. Several implementations use a log file name that the     database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log     file name. This often suffices for the database superuser to escalate to root privileges when root starts     the server. (CVE-2017-12172)

  - Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker     with access to the postgres user account could use these flaws to obtain root access on the server     machine. (CVE-2017-15097)

  - It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17,     9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use     this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

  - PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses     foreign server passwords to any user having USAGE privilege on the associated foreign server.
    (CVE-2017-7486)

  - A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.
    An attacker with a user account could use this flaw to execute code with the permissions of superuser in     the database. Versions 9.3 through 10 are affected. (CVE-2018-1058)

  - A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory     and not check the host name if a host name verifier was not provided to the driver. This could lead to a     condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a     certificate for the wrong host, as long as it was signed by a trusted CA. (CVE-2018-10936)

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

  - An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly     sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP     signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user     with sufficient privileges at the OS level (the postgres account or the root account). (CVE-2020-21469)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

  - A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on     one column to craft a special query that returns all columns of the table. The highest threat from this     vulnerability is to confidentiality. (CVE-2021-20229)

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

  - A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an     authenticated database user could read arbitrary bytes of server memory. The highest threat from this     vulnerability is to data confidentiality. (CVE-2021-32029)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

  - A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects     in at least one schema, the ability to lure or wait for an administrator to create or update an affected     extension in that schema, and the ability to lure or wait for a victim to use the object targeted in     CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to     run arbitrary code as the victim role, which may be a superuser. (CVE-2022-2625)

  - In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes. (CVE-2022-41862)

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

  - A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack. (CVE-2023-5870)

  - Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the     owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a     superuser or member of one of the attacker's roles. The attack requires luring the victim into running     REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this     vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built     temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only     known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the     protections that older branches are using to fix their vulnerability. (CVE-2024-0985)

  - Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table ownermore details     (CVE-2024-4317)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

From Red Hat Security Advisory 2017:3402 :

An update for postgresql is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es) :

* Privilege escalation flaws were found in the initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.
(CVE-2017-12172, CVE-2017-15097)

Note: This patch drops the script privileges from root to the postgres user. Therefore, this update works properly only if the postgres user has write access to the postgres' home directory, such as the one in the default configuration (/var/lib/pgsql).

Red Hat would like to thank the PostgreSQL project for reporting CVE-2017-12172. The CVE-2017-15097 issue was discovered by Pedro Barbosa (Red Hat) and the PostgreSQL project. Upstream acknowledges Antoine Scemama (Brainloop) as the original reporter of these issues.

The remote NewStart CGSL host, running version MAIN 5.04, has postgresql packages installed that are affected by multiple vulnerabilities:

  - Privilege escalation flaws were found in the Red Hat     initialization scripts of PostgreSQL. An attacker with     access to the postgres user account could use these     flaws to obtain root access on the server machine.
    (CVE-2017-15097)

  - Privilege escalation flaws were found in the     initialization scripts of PostgreSQL. An attacker with     access to the postgres user account could use these     flaws to obtain root access on the server machine.
    (CVE-2017-12172)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Privilege escalation flaws were found in the     initialization scripts of PostgreSQL. An attacker with     access to the postgres user account could use these     flaws to obtain root access on the server machine.
    (CVE-2017-12172, CVE-2017-15097)

Note: This patch drops the script privileges from root to the postgres user. Therefore, this update works properly only if the postgres user has write access to the postgres' home directory, such as the one in the default configuration (/var/lib/pgsql).

ID	Name	Product	Family	Published	Updated	Severity
105321	EulerOS 2.0 SP1 : postgresql (EulerOS-SA-2017-1340)	Nessus	Huawei Local Security Checks	12/18/2017	1/6/2021	medium
105092	RHEL 7 : postgresql (RHSA-2017:3402)	Nessus	Red Hat Local Security Checks	12/8/2017	4/27/2024	medium
105322	EulerOS 2.0 SP2 : postgresql (EulerOS-SA-2017-1341)	Nessus	Huawei Local Security Checks	12/18/2017	1/6/2021	medium
195404	RHEL 5 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
105114	CentOS 7 : postgresql (CESA-2017:3402)	Nessus	CentOS Local Security Checks	12/11/2017	1/4/2021	medium
194128	RHEL 6 / 7 : rh-postgresql96-postgresql (RHSA-2017:3405)	Nessus	Red Hat Local Security Checks	4/27/2024	4/27/2024	medium
195391	RHEL 6 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
105142	Oracle Linux 7 : postgresql (ELSA-2017-3402)	Nessus	Oracle Linux Local Security Checks	12/11/2017	1/14/2021	medium
127150	NewStart CGSL MAIN 5.04 : postgresql Multiple Vulnerabilities (NS-SA-2019-0006)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	medium
105387	Scientific Linux Security Update : postgresql on SL7.x x86_64 (20171219)	Nessus	Scientific Linux Local Security Checks	12/20/2017	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

critical

medium

medium

high

medium

medium

medium