The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3314:01 advisory.

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)
    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)
    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)
    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)
    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)
    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)
    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2511 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql     (9.5.14). (BZ#1612671)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, and CVE-2017-15099. Upstream acknowledges Andrew Krasichkov as the original     reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom Lane as the     original reporter of CVE-2018-1053; and Dean Rasheed as the original reporter of CVE-2017-15099.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PostgreSQL project reports :

- CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)

- CVE-2018-1053: Ensure that all temporary files made with 'pg_upgrade' are non-world-readable

This update for postgresql96 to version 9.6.7 fixes the following issues :

  - CVE-2018-1053: Ensure that all temporary files made by     pg_upgrade are non-world-readable. (bsc#1077983)

A full changelog is available here :

&#9;https://www.postgresql.org/docs/9.6/static/release-9-6-7.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql94 fixes the following issues :

PostgreSQL was updated to version 9.4.15, the full release notes are here :

&#9;https://www.postgresql.org/docs/9.4/static/release-9-4-15.html

  - CVE-2018-1053: Ensure that all temporary files made by     pg_upgrade are non-world-readable. (bsc#1077983)

This update was imported from the SUSE:SLE-12:Update update project.

An update of the postgresql package has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3816 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925 and     CVE-2018-1053. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915; and Tom     Lane as the original reporter of CVE-2018-1053.

    Additional Changes:

    This update fixes various bugs and adds enhancements. Documentation for these changes is available from     the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3313:01 advisory.

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)
    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)
    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)
    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)
    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)
    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289078	MiracleLinux 4 : rh-postgresql96-postgresql-9.6.10-1.AXS4 (AXSA:2018-3314:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
194013	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2018:2511)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/5	high
106701	FreeBSD : PostgreSQL vulnerabilities (c602c791-0cf4-11e8-a2ec-6cc21735f730)	Nessus	FreeBSD Local Security Checks	2018/2/9	2025/10/30	high
106964	openSUSE Security Update : postgresql96 (openSUSE-2018-203)	Nessus	SuSE Local Security Checks	2018/2/23	2025/10/29	high
108391	openSUSE Security Update : postgresql94 (openSUSE-2018-257)	Nessus	SuSE Local Security Checks	2018/3/16	2025/4/4	high
121809	Photon OS 1.0: Postgresql PHSA-2018-1.0-0108	Nessus	PhotonOS Local Security Checks	2019/2/7	2025/3/20	high
194110	RHEL 7 : CloudForms 4.6.6 (RHSA-2018:3816)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/6/3	high
289373	MiracleLinux 4 : rh-postgresql95-postgresql-9.5.14-1.AXS4 (AXSA:2018-3313:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high

检测

插件搜索

critical

high

high

high

high

high

high

high