The version of PostgreSQL installed on the remote host is 11 prior to 11.11, 12 prior to 12.6, or 13 prior to 13.2. As such, it is potentially affected by multiple vulnerabilities :

  - An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11.
    A user having UPDATE permission but not SELECT permission to a particular column could craft queries     which, under some circumstances, might disclose values from that column in error messages. An attacker     could use this flaw to obtain information stored in a column they are allowed to write but not read.
    (CVE-2021-3393)

  - A flaw was found in PostgreSQL in versions before 13.2, before 12.6, before 11.11. This flaw allows a     user with SELECT privilege on one column to craft a special query that returns all columns of the table.
    The highest threat from this vulnerability is to confidentiality (CVE-2021-20229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

For more information about these vulnerabilities, refer to the Postgresql News Page.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-32 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    An authenticated remote attacker, by executing malicious crafted       queries, could possibly disclose sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for postgresql13 fixes the following issues :

Upgrade to version 13.2 :

Updating stored views and reindexing might be needed after applying this update.

CVE-2021-3393, bsc#1182040: Fix information leakage in constraint-violation error messages.

CVE-2021-20229, bsc#1182039: Fix failure to check per-column SELECT privileges in some join queries.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql13 fixes the following issues :

Upgrade to version 13.2 :

  - Updating stored views and reindexing might be needed     after applying this update.

  - CVE-2021-3393, bsc#1182040: Fix information leakage in     constraint-violation error messages.

  - CVE-2021-20229, bsc#1182039: Fix failure to check     per-column SELECT privileges in some join queries.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server     crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression     within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the     equality operator used for a CASE expression involving values of different types. (CVE-2016-5423)

  - PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before     9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser     privileges via a (1)  (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in     a (a) database or (b) role name that is mishandled during an administrative operation. (CVE-2016-5424)

  - PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before     9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers     have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for     starting the database server during system boot. Packages of PostgreSQL for many operating systems provide     their own, packager-authored startup implementations. Several implementations use a log file name that the     database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log     file name. This often suffices for the database superuser to escalate to root privileges when root starts     the server. (CVE-2017-12172)

  - Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker     with access to the postgres user account could use these flaws to obtain root access on the server     machine. (CVE-2017-15097)

  - It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17,     9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use     this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

  - PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses     foreign server passwords to any user having USAGE privilege on the associated foreign server.
    (CVE-2017-7486)

  - A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users.
    An attacker with a user account could use this flaw to execute code with the permissions of superuser in     the database. Versions 9.3 through 10 are affected. (CVE-2018-1058)

  - A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory     and not check the host name if a host name verifier was not provided to the driver. This could lead to a     condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a     certificate for the wrong host, as long as it was signed by a trusted CA. (CVE-2018-10936)

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

  - An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly     sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP     signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user     with sufficient privileges at the OS level (the postgres account or the root account). (CVE-2020-21469)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

  - A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on     one column to craft a special query that returns all columns of the table. The highest threat from this     vulnerability is to confidentiality. (CVE-2021-20229)

  - When the server is configured to use trust authentication with a clientcert requirement or to use cert     authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first     established, despite the use of SSL certificate verification and encryption. (CVE-2021-23214)

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

  - A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an     authenticated database user could read arbitrary bytes of server memory. The highest threat from this     vulnerability is to data confidentiality. (CVE-2021-32029)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

  - A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects     in at least one schema, the ability to lure or wait for an administrator to create or update an affected     extension in that schema, and the ability to lure or wait for a victim to use the object targeted in     CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to     run arbitrary code as the victim role, which may be a superuser. (CVE-2022-2625)

  - In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes. (CVE-2022-41862)

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

  - A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack. (CVE-2023-5870)

  - Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the     owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a     superuser or member of one of the attacker's roles. The attack requires luring the victim into running     REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this     vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built     temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only     known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the     protections that older branches are using to fix their vulnerability. (CVE-2024-0985)

  - Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table ownermore details     (CVE-2024-4317)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
148419	PostgreSQL 11.x < 11.11 / 12.x < 12.6 / 13.x < 13.2 Multiple Vulnerabilities	Nessus	Databases	4/9/2021	1/5/2024	medium
184156	Puppet Enterprise < 2019.8.6 PostgreSQL Vulnerabilities	Nessus	Misc.	11/1/2023	11/2/2023	medium
157026	GLSA-202105-32 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/24/2022	1/16/2024	medium
146785	SUSE SLES12 Security Update : postgresql13 (SUSE-SU-2021:0545-1)	Nessus	SuSE Local Security Checks	2/23/2021	1/19/2024	medium
146788	SUSE SLED15 / SLES15 Security Update : postgresql13 (SUSE-SU-2021:0543-1)	Nessus	SuSE Local Security Checks	2/23/2021	1/19/2024	medium
195391	RHEL 6 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high