This update for postgresql94 to 9.4.12 fixes the following issues:
Upstream changelogs :

- https://www.postgresql.org/docs/9.4/static/release-9-4-12.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-11.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-10.html Security issues fixed :

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624) Please note that     manual action is needed to fix this in existing     databases See the upstream release notes for details.

  - CVE-2017-7485: recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603) Changes     in version 9.4.12 :

  - Build corruption with CREATE INDEX CONCURRENTLY

  - Fixes for visibility and write-ahead-log stability     Changes in version 9.4.10 :

  - Fix WAL-logging of truncation of relation free space     maps and visibility maps

  - Fix incorrect creation of GIN index WAL records on     big-endian machines

  - Fix SELECT FOR UPDATE/SHARE to correctly lock tuples     that have been updated by a subsequently-aborted     transaction

  - Fix EvalPlanQual rechecks involving CTE scans

  - Fix improper repetition of previous results from hashed     aggregation in a subquery The libraries libpq and     libecpg are now supplied by postgresql 9.6.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes CVE-2017-7484 CVE-2017-7485 CVE-2017-7486.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1727:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS).
    The base postgresql package contains the client programs that you'll need to     access a PostgreSQL DBMS server, as well as HTML documentation for the whole     system.  These client programs can be located on the same machine as the     PostgreSQL server, or on a remote machine that accesses a PostgreSQL server     over a network connection.  The PostgreSQL server can be found in the     postgresql-server sub-package.
    Security issues fixed with this release:
    CVE-2017-7484     It was found that some selectivity estimation functions in PostgreSQL     before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information.
    An unprivileged attacker could use this flaw to steal some information     from tables they are otherwise not allowed to access.
    CVE-2017-7485     In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL     environment variable was no longer enforcing a SSL/TLS connection to a     PostgreSQL server. An active Man-in-the-Middle attacker could use this     flaw to strip the SSL/TLS protection from a connection between a     client and a server.
    CVE-2017-7486     PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in     pg_user_mappings view which discloses foreign server passwords to any     user having USAGE privilege on the associated foreign server.
    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.7).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql93 fixes the following issues: The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes. Bug fixes :

  - bsc#1029547: Fix tests with timezone 2017a

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624)

  - CVE-2017-7485: Recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603) More     details can be found in the PostgreSQL release     announcements :

- https://www.postgresql.org/docs/9.3/static/release-9-3-17.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-16.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-15.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for rh-postgresql95-postgresql is now available for Red Hat Satellite 5.8 and Red Hat Satellite 5.8 ELS.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

This update applies only to Satellite 5.8 instances using either embedded or managed PostgreSQL databases.

There are manual steps required in order to finish the migration from postgresql92-postgresql to rh-postgresql95-postgresql. If these steps are not undertaken, the affected Satellite will continue to use PostgreSQL 9.2.

postgresql92-postgresql will be upgraded automatically to rh-postgresql95-postgresql as part of an upgrade to Satellite 5.8.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es) :

* It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

* It was discovered that the PostgreSQL client library (libpq) did not enforce the use of TLS/SSL for a connection to a PostgreSQL server when the PGREQUIRESSL environment variable was set. An man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
(CVE-2017-7485)

* It was found that the pg_user_mappings view could disclose information about user mappings to a foreign database to non-administrative database users. A database user with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database. (CVE-2017-7486)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Robert Haas as the original reporter of CVE-2017-7484; Daniel Gustafsson as the original reporter of CVE-2017-7485; and Andrew Wheelwright as the original reporter of CVE-2017-7486.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1726:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS).
    The base postgresql package contains the client programs that you'll need to     access a PostgreSQL DBMS server, as well as HTML documentation for the whole     system.  These client programs can be located on the same machine as the     PostgreSQL server, or on a remote machine that accesses a PostgreSQL server     over a network connection.  The PostgreSQL server can be found in the     postgresql-server sub-package.
    Security issues fixed with this release:
    CVE-2017-7484     It was found that some selectivity estimation functions in PostgreSQL     before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information.
    An unprivileged attacker could use this flaw to steal some information     from tables they are otherwise not allowed to access.
    CVE-2017-7485     In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL     environment variable was no longer enforcing a SSL/TLS connection to a     PostgreSQL server. An active Man-in-the-Middle attacker could use this     flaw to strip the SSL/TLS protection from a connection between a     client and a server.
    CVE-2017-7486     PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in     pg_user_mappings view which discloses foreign server passwords to any     user having USAGE privilege on the associated foreign server.
    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.7).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1728:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS).
    The base postgresql package contains the client programs that you'll need to     access a PostgreSQL DBMS server, as well as HTML documentation for the whole     system.  These client programs can be located on the same machine as the     PostgreSQL server, or on a remote machine that accesses a PostgreSQL server     over a network connection.  The PostgreSQL server can be found in the     postgresql-server sub-package.
    Security issues fixed with this release     CVE-2017-7484     It was found that some selectivity estimation functions in PostgreSQL     before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information.
    An unprivileged attacker could use this flaw to steal some information     from tables they are otherwise not allowed to access.
    CVE-2017-7485     In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL     environment variable was no longer enforcing a SSL/TLS connection to a     PostgreSQL server. An active Man-in-the-Middle attacker could use this     flaw to strip the SSL/TLS protection from a connection between a     client and a server.
    CVE-2017-7486     PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in     pg_user_mappings view which discloses foreign server passwords to any     user having USAGE privilege on the associated foreign server.
    The following packages have been upgraded to a later upstream version: rh-postgresql94-postgresql     (9.4.12).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1729:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS).
    The base postgresql package contains the client programs that you'll need to     access a PostgreSQL DBMS server, as well as HTML documentation for the whole     system.  These client programs can be located on the same machine as the     PostgreSQL server, or on a remote machine that accesses a PostgreSQL server     over a network connection.  The PostgreSQL server can be found in the     postgresql-server sub-package.
    Security issues fixed with this release:
    CVE-2017-7484     It was found that some selectivity estimation functions in PostgreSQL     before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3 did not check user privileges before     providing information from pg_statistic, possibly leaking information.
    An unprivileged attacker could use this flaw to steal some information     from tables they are otherwise not allowed to access.
    CVE-2017-7485     In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before     9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL     environment variable was no longer enforcing a SSL/TLS connection to a     PostgreSQL server. An active Man-in-the-Middle attacker could use this     flaw to strip the SSL/TLS protection from a connection between a     client and a server.
    CVE-2017-7486     PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in     pg_user_mappings view which discloses foreign server passwords to any     user having USAGE privilege on the associated foreign server.
    The following packages have been upgraded to a later upstream version: rh-postgresql94-postgresql     (9.4.12).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2425 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.7).
    (BZ#1449701)

    Security Fix(es):

    * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN     commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL     to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423)

    * A flaw was found in the way PostgreSQL client programs handled database and role names containing     newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the     CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes     maintenance with a vulnerable client program. (CVE-2016-5424)

    * It was found that some selectivity estimation functions did not check user privileges before providing     information from pg_statistic, possibly leaking information. A non-administrative database user could use     this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

    * It was discovered that the PostgreSQL client library (libpq) did not enforce the use of TLS/SSL for a     connection to a PostgreSQL server when the PGREQUIRESSL environment variable was set. An man-in-the-middle     attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a     server. (CVE-2017-7485)

    * It was found that the pg_user_mappings view could disclose information about user mappings to a foreign     database to non-administrative database users. A database user with USAGE privilege for this mapping     could, when querying the view, obtain user mapping data, such as the username and password used to connect     to the foreign database. (CVE-2017-7486)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges     Robert Haas as the original reporter of CVE-2017-7484; Daniel Gustafsson as the original reporter of     CVE-2017-7485; and Andrew Wheelwright as the original reporter of CVE-2017-7486.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql93 fixes the following issues :

The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes.

Security fixes :

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624) 

  - CVE-2017-7485: Recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603)

More details can be found in the PostgreSQL release announcements :

- https://www.postgresql.org/docs/9.3/static/release-9-3-17.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-16.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-15.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql93 fixes the following issues :

  - bsc#1029547: Fix tests with timezone 2017a

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624)

  - CVE-2017-7485: Recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Selectivity estimators bypass SELECT privilege checks

It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

libpq ignores PGREQUIRESSL environment variable

It was found that the PGREQUIRESSL was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. (CVE-2017-7485)

pg_user_mappings view discloses foreign server passwords

It was found that the pg_user_mappings view from postgresql could disclose information about user mappings to a foreign database to unprivileged users. An authenticated attacker with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database. (CVE-2017-7486)

The version of PostgreSQL installed on the remote host is 9.2.x prior to 9.2.21, 9.3.x prior to 9.3.17, 9.4.x prior to 9.4.12, 9.5.x prior to 9.5.7, or 9.6.x prior to 9.6.3. It is, therefore, affected by multiple vulnerabilities :

  - A information disclosure vulnerability exists in     unspecified selectivity estimation functions due to     improper checking of user privileges before providing     information from pg_statistics. An authenticated, remote     attacker can exploit this to disclose potentially     sensitive information from restricted tables.
    (CVE-2017-7484)

  - A flaw exists because the PGREQUIRESSL environment     variable setting is not properly honored, which results     in a failure to require appropriate SSL/TLS connections.
    A man-in-the-middle attacker can exploit this to cause     an insecure, non-SSL/TLS connection between a client and     and a server. Note that version 9.2.x is not affected by     this vulnerability. (CVE-2017-7485)

  - A information disclosure vulnerability exists in the     pg_user_mappings view that allows access to user     mappings which may contain passwords that have persisted     from the CREATE USER MAPPING command. An authenticated,     remote attacker who has USAGE privilege on the     associated foreign server can exploit this to disclose     foreign server passwords. (CVE-2017-7486)

This update for postgresql94 to 9.4.12 fixes the following issues :

Upstream changelogs :

- https://www.postgresql.org/docs/9.4/static/release-9-4-12.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-11.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-10.html

Security issues fixed :

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624)

    Please note that manual action is needed to fix this in     existing databases See the upstream release notes for     details.

  - CVE-2017-7485: recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603)

Changes in version 9.4.12 :

  - Build corruption with CREATE INDEX CONCURRENTLY

  - Fixes for visibility and write-ahead-log stability

Changes in version 9.4.10 :

  - Fix WAL-logging of truncation of relation free space     maps and visibility maps

  - Fix incorrect creation of GIN index WAL records on     big-endian machines

  - Fix SELECT FOR UPDATE/SHARE to correctly lock tuples     that have been updated by a subsequently-aborted     transaction

  - Fix EvalPlanQual rechecks involving CTE scans

  - Fix improper repetition of previous results from hashed     aggregation in a subquery

The libraries libpq and libecpg are now supplied by postgresql 9.6.

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is affected by the vulnerability described in GLSA-201710-06 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could escalate privileges, cause a Denial of Service       condition, obtain passwords, cause a loss in information, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101060	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2017:1690-1)	Nessus	SuSE Local Security Checks	2017/6/27	2025/12/15	high
101572	Fedora 26 : mingw-postgresql (2017-0d5817efc0)	Nessus	Fedora Local Security Checks	2017/7/17	2025/12/10	high
289143	MiracleLinux 4 : rh-postgresql95-postgresql-9.5.7-2.AXS4 (AXSA:2017-1727:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
100538	SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2017:1441-1)	Nessus	SuSE Local Security Checks	2017/5/31	2025/12/17	high
102142	RHEL 5 : rh-postgresql95-postgresql (RHSA-2017:1838)	Nessus	Red Hat Local Security Checks	2017/8/3	2025/12/4	high
289822	MiracleLinux 7 : rh-postgresql95-postgresql-9.5.7-2.el7 (AXSA:2017-1726:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
290040	MiracleLinux 4 : rh-postgresql94-postgresql-9.4.12-1.AXS4 (AXSA:2017-1728:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
291558	MiracleLinux 7 : rh-postgresql94-postgresql-9.4.12-1.el7 (AXSA:2017-1729:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high
210311	RHEL 6 : rh-postgresql95-postgresql (RHSA-2017:2425)	Nessus	Red Hat Local Security Checks	2024/11/5	2024/11/5	high
100659	openSUSE Security Update : postgresql93 (openSUSE-2017-657)	Nessus	SuSE Local Security Checks	2017/6/7	2025/12/17	high
101260	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2017:1783-1)	Nessus	SuSE Local Security Checks	2017/7/6	2025/12/12	high
100640	Amazon Linux AMI : postgresql93 / postgresql94,postgresql95 (ALAS-2017-839)	Nessus	Amazon Linux Local Security Checks	2017/6/7	2025/12/17	high
100260	PostgreSQL 9.2.x < 9.2.21 / 9.3.x < 9.3.17 / 9.4.x < 9.4.12 / 9.5.x < 9.5.7 / 9.6.x < 9.6.3 Multiple Vulnerabilities	Nessus	Databases	2017/5/17	2025/2/5	high
101220	openSUSE Security Update : postgresql94 (openSUSE-2017-770)	Nessus	SuSE Local Security Checks	2017/7/5	2025/12/12	high
103724	GLSA-201710-06 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/10/9	2025/11/19	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical