The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3313:01 advisory.

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)
    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)
    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)
    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)
    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)
    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3589-1 advisory.

    It was discovered that PostgreSQL incorrectly handled certain settings. An attacker could possibly use     this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for postgresql94 fixes the following issues :

Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925).

Bug fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.4/static/release-9-4-17.html

  - https://www.postgresql.org/docs/9.4/static/release-9-4-16.html

This update was imported from the SUSE:SLE-12:Update update project.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2566 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql96-postgresql     (9.6.10). (BZ#1614340)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, CVE-2017-15099, and CVE-2018-1115. Upstream acknowledges Andrew Krasichkov     as the original reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom     Lane as the original reporter of CVE-2018-1053; Dean Rasheed as the original reporter of CVE-2017-15099;
    and Stephen Frost as the original reporter of CVE-2018-1115.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3310:01 advisory.

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)
    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)
    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)
    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)
    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)
    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)
    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PostgreSQL project reports :

- CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications

Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. (CVE-2018-1058)

An update of {'postgresql'} packages of Photon OS has been released.

An update of the postgresql package has been released.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1515:01 advisory.

    * postgresql: Reconnection can downgrade connection security settings     (CVE-2020-25694)
      * postgresql: Multiple features escape security restricted operation sandbox     (CVE-2020-25695)
      * postgresql: Uncontrolled search path element in logical replication     (CVE-2020-14349)
      * postgresql: Uncontrolled search path element in CREATE EXTENSION     (CVE-2020-14350)
      * postgresql: psql's \gset allows overwriting specially treated variables     (CVE-2020-25696)
      * postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks     (CVE-2020-1720)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3314:01 advisory.

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)
    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)
    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)
    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)
    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)
    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)
    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql95 fixes the following issues :

Security issue fixed in PostgreSQL 9.5.12 :

  - CVE-2018-1058: Uncontrolled search path element in     pg_dump and other client applications (boo#1081925).

This update for postgresql94 fixes the following issues: Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925). Bug     fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.4/static/release-9-4-17.html

  - https://www.postgresql.org/docs/9.4/static/release-9-4-16.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of 'postgresql' packages of Photon OS has been released.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2511 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql     (9.5.14). (BZ#1612671)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, and CVE-2017-15099. Upstream acknowledges Andrew Krasichkov as the original     reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom Lane as the     original reporter of CVE-2018-1053; and Dean Rasheed as the original reporter of CVE-2017-15099.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289373	MiracleLinux 4 : rh-postgresql95-postgresql-9.5.14-1.AXS4 (AXSA:2018-3313:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
107192	Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerability (USN-3589-1)	Nessus	Ubuntu Local Security Checks	2018/3/7	2024/8/27	high
108932	openSUSE Security Update : postgresql94 (openSUSE-2018-340)	Nessus	SuSE Local Security Checks	2018/4/10	2024/11/12	high
194117	RHEL 6 / 7 : rh-postgresql96-postgresql (RHSA-2018:2566)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/5	critical
289274	MiracleLinux 7 : rh-postgresql96-postgresql-9.6.10-1.el7 (AXSA:2018-3310:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
107112	FreeBSD : PostgreSQL vulnerabilities (e3eeda2e-1d67-11e8-a2ec-6cc21735f730)	Nessus	FreeBSD Local Security Checks	2018/3/2	2025/10/27	high
108851	Amazon Linux AMI : postgresql93 / postgresql94,postgresql95,postgresql96 (ALAS-2018-990)	Nessus	Amazon Linux Local Security Checks	2018/4/6	2024/11/20	high
111294	Photon OS 2.0 : postgresql (PhotonOS-PHSA-2018-2.0-0031) (deprecated)	Nessus	PhotonOS Local Security Checks	2018/7/24	2019/2/7	high
121817	Photon OS 1.0: Postgresql PHSA-2018-1.0-0122	Nessus	PhotonOS Local Security Checks	2019/2/7	2019/2/7	high
294666	MiracleLinux 8 : postgresql:12 (AXSA:2021-1515:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
289078	MiracleLinux 4 : rh-postgresql96-postgresql-9.6.10-1.AXS4 (AXSA:2018-3314:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
108443	openSUSE Security Update : postgresql95 (openSUSE-2018-279)	Nessus	SuSE Local Security Checks	2018/3/19	2025/1/29	high
108530	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2018:0755-1)	Nessus	SuSE Local Security Checks	2018/3/22	2024/12/19	high
111926	Photon OS 1.0: Postgresql PHSA-2018-1.0-0122 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	high
121931	Photon OS 2.0: Postgresql PHSA-2018-2.0-0031	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	high
194013	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2018:2511)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/5	high

检测

插件搜索

high

high

high

critical

critical

high

high

high

high

high

critical

high

high

high

high

high