This update for postgresql96 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259) The changelog for this release is here:
    https://www.postgresql.org/docs/9.6/static/release-9-6-4     .html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that authenticating to a PostgreSQL     database account with an empty password was possible     despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain     access to database accounts with empty passwords.
    (CVE-2017-7546)

  - An authorization flaw was found in the way PostgreSQL     handled access to the pg_user_mappings view on foreign     servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from     the user mappings defined by the foreign server owners     without actually having the privileges to do so.
    (CVE-2017-7547)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2678 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql94-postgresql     (9.4.14). (BZ#1484635, BZ#1484638, BZ#1484644)

    Security Fix(es):

    * It was found that authenticating to a PostgreSQL database account with an empty password was possible     despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to     gain access to database accounts with empty passwords. (CVE-2017-7546)

    * An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on     foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords     from the user mappings defined by the foreign server owners without actually having the privileges to do     so. (CVE-2017-7547)

    * An authorization flaw was found in the way PostgreSQL handled large objects. A remote, authenticated     attacker with no privileges on a large object could potentially use this flaw to overwrite the entire     content of the object, thus resulting in denial of service. (CVE-2017-7548)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben     de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; Jeff Janes as     the original reporter of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been found in the PostgreSQL database system :

CVE-2017-7486

Andrew Wheelwright discovered that user mappings were insufficiently restricted.

CVE-2017-7546

In some authentication methods empty passwords were accepted.

CVE-2017-7547

User mappings could leak data to unprivileged users.

For Debian 7 'Wheezy', these problems have been fixed in version 9.1.24lts2-0+deb7u1.

We recommend that you upgrade your postgresql-9.1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Postgresql93 was updated to 9.3.18 to fix the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

The changelog for the release is here :

&#9;https://www.postgresql.org/docs/9.3/static/release-9-3-18.html

This update was imported from the SUSE:SLE-12:Update update project.

An update for postgresql is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version:
postgresql (9.2.23). (BZ#1484639, BZ#1484647)

Security Fix(es) :

* It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)

* An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. (CVE-2017-7547)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; and Jeff Janes as the original reporter of CVE-2017-7547.

The pg_user_mappings view discloses passwords to users lacking server privileges :

An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. (CVE-2017-7547)

Empty password accepted in some authentication methods :

It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)

This update for postgresql95 fixes the following issues :

Upate to PostgreSQL 9.5.11 :

Security issues fixed :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-11.html 

  - CVE-2018-1053, boo#1077983: Ensure that all temporary     files made by pg_upgrade are non-world-readable. 

  - boo#1079757: Rename pg_rewind's copy_file_range function     to avoid conflict with new Linux system call of that     name.

In version 9.5.10 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-10.html

  - CVE-2017-15098, boo#1067844: Memory disclosure in JSON     functions.

  - CVE-2017-15099, boo#1067841: INSERT ... ON CONFLICT DO     UPDATE fails to enforce SELECT privileges.

In version 9.5.9 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-9.html

  - Show foreign tables in     information_schema.table_privileges view.

  - Clean up handling of a fatal exit (e.g., due to receipt     of SIGTERM) that occurs while trying to execute a     ROLLBACK of a failed transaction.

  - Remove assertion that could trigger during a fatal exit.

  - Correctly identify columns that are of a range type or     domain type over a composite type or domain type being     searched for.

  - Fix crash in pg_restore when using parallel mode and     using a list file to select a subset of items to     restore.

  - Change ecpg's parser to allow RETURNING clauses without     attached C variables.

In version 9.5.8

  - https://www.postgresql.org/docs/9.5/static/release-9-5-8.html

  - CVE-2017-7547, boo#1051685: Further restrict visibility     of pg_user_mappings.umoptions, to protect passwords     stored as user mapping options.

  - CVE-2017-7546, boo#1051684: Disallow empty passwords in     all password-based authentication methods.

  - CVE-2017-7548, boo#1053259: lo_put() function ignores     ACLs.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2677 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.9).
    (BZ#1484637, BZ#1484642, BZ#1484648)

    Security Fix(es):

    * It was found that authenticating to a PostgreSQL database account with an empty password was possible     despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to     gain access to database accounts with empty passwords. (CVE-2017-7546)

    * An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on     foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords     from the user mappings defined by the foreign server owners without actually having the privileges to do     so. (CVE-2017-7547)

    * An authorization flaw was found in the way PostgreSQL handled large objects. A remote, authenticated     attacker with no privileges on a large object could potentially use this flaw to overwrite the entire     content of the object, thus resulting in denial of service. (CVE-2017-7548)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben     de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; Jeff Janes as     the original reporter of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2241:02 advisory.

    * It was found that authenticating to a PostgreSQL database account with an     empty password was possible despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain access to database     accounts with empty passwords. (CVE-2017-7546)
      * An authorization flaw was found in the way PostgreSQL handled access to the     pg_user_mappings view on foreign servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the user mappings defined     by the foreign server owners without actually having the privileges to do so.
    (CVE-2017-7547)
      * An authorization flaw was found in the way PostgreSQL handled large objects.
    A remote, authenticated attacker with no privileges on a large object could     potentially use this flaw to overwrite the entire content of the object, thus     resulting in denial of service. (CVE-2017-7548)     Asianux would like to thank the PostgreSQL project for reporting these issues.
    Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as     the original reporters of CVE-2017-7546; Jeff Janes as the original reporter     of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.
    CVE-2017-7546     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to incorrect authentication flaw allowing remote attackers     to gain access to database accounts with an empty password.
    CVE-2017-7547     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to authorization flaw allowing remote authenticated     attackers to retrieve passwords from the user mappings defined by the     foreign server owners without actually having the privileges to do so.
    CVE-2017-7548     PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to     authorization flaw allowing remote authenticated attackers with no     privileges on a large object to overwrite the entire contents of the     object, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2280:02 advisory.

    * It was found that authenticating to a PostgreSQL database account with an     empty password was possible despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain access to database     accounts with empty passwords. (CVE-2017-7546)
      * An authorization flaw was found in the way PostgreSQL handled access to the     pg_user_mappings view on foreign servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the user mappings defined     by the foreign server owners without actually having the privileges to do so.
    (CVE-2017-7547)
      * An authorization flaw was found in the way PostgreSQL handled large objects.
    A remote, authenticated attacker with no privileges on a large object could     potentially use this flaw to overwrite the entire content of the object, thus     resulting in denial of service. (CVE-2017-7548)     Asianux would like to thank the PostgreSQL project for reporting these issues.
    Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as     the original reporters of CVE-2017-7546; Jeff Janes as the original reporter     of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.
    CVE-2017-7546     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to incorrect authentication flaw allowing remote attackers     to gain access to database accounts with an empty password.
    CVE-2017-7547     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to authorization flaw allowing remote authenticated     attackers to retrieve passwords from the user mappings defined by the     foreign server owners without actually having the privileges to do so.
    CVE-2017-7548     PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to     authorization flaw allowing remote authenticated attackers with no     privileges on a large object to overwrite the entire contents of the     object, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql94 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

This update was imported from the SUSE:SLE-12:Update update project.

The following packages have been upgraded to a later upstream version:
postgresql (9.2.23).

Security Fix(es) :

  - It was found that authenticating to a PostgreSQL     database account with an empty password was possible     despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain     access to database accounts with empty passwords.
    (CVE-2017-7546)

  - An authorization flaw was found in the way PostgreSQL     handled access to the pg_user_mappings view on foreign     servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the     user mappings defined by the foreign server owners     without actually having the privileges to do so.
    (CVE-2017-7547)

The remote host is affected by the vulnerability described in GLSA-201710-06 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could escalate privileges, cause a Denial of Service       condition, obtain passwords, cause a loss in information, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

rebase: update to 9.6.4, security fix for CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 

Per release notes:
https://www.postgresql.org/docs/9.6/static/release-9-6-4.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2240:02 advisory.

    * It was found that authenticating to a PostgreSQL database account with an     empty password was possible despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain access to database     accounts with empty passwords. (CVE-2017-7546)
      * An authorization flaw was found in the way PostgreSQL handled access to the     pg_user_mappings view on foreign servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the user mappings defined     by the foreign server owners without actually having the privileges to do so.
    (CVE-2017-7547)
      * An authorization flaw was found in the way PostgreSQL handled large objects.
    A remote, authenticated attacker with no privileges on a large object could     potentially use this flaw to overwrite the entire content of the object, thus     resulting in denial of service. (CVE-2017-7548)     Asianux would like to thank the PostgreSQL project for reporting these issues.
    Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as     the original reporters of CVE-2017-7546; Jeff Janes as the original reporter     of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.
    CVE-2017-7546     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to incorrect authentication flaw allowing remote attackers     to gain access to database accounts with an empty password.
    CVE-2017-7547     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to authorization flaw allowing remote authenticated     attackers to retrieve passwords from the user mappings defined by the     foreign server owners without actually having the privileges to do so.
    CVE-2017-7548     PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to     authorization flaw allowing remote authenticated attackers with no     privileges on a large object to overwrite the entire contents of the     object, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102974	SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2017:2356-1)	Nessus	SuSE Local Security Checks	2017/9/6	2025/11/24	critical
103734	EulerOS 2.0 SP2 : postgresql (EulerOS-SA-2017-1232)	Nessus	Huawei Local Security Checks	2017/10/10	2025/11/19	critical
210315	RHEL 6 / 7 : rh-postgresql94-postgresql (RHSA-2017:2678)	Nessus	Red Hat Local Security Checks	2024/11/5	2024/11/5	critical
102368	Debian DLA-1051-1 : postgresql-9.1 security update	Nessus	Debian Local Security Checks	2017/8/11	2025/12/2	critical
102847	openSUSE Security Update : postgresql93 (openSUSE-2017-985)	Nessus	SuSE Local Security Checks	2017/8/31	2025/11/25	critical
103230	CentOS 7 : postgresql (CESA-2017:2728)	Nessus	CentOS Local Security Checks	2017/9/15	2021/1/4	critical
103755	Amazon Linux AMI : postgresql96 (ALAS-2017-908)	Nessus	Amazon Linux Local Security Checks	2017/10/11	2025/11/19	critical
106965	openSUSE Security Update : postgresql95 (openSUSE-2018-204)	Nessus	SuSE Local Security Checks	2018/2/23	2025/10/29	critical
210267	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2017:2677)	Nessus	Red Hat Local Security Checks	2024/11/5	2024/11/5	critical
289654	MiracleLinux 7 : rh-postgresql94-postgresql-9.4.14-1.el7 (AXSA:2017-2241:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
289148	MiracleLinux 4 : rh-postgresql95-postgresql-9.5.9-1.AXS4 (AXSA:2017-2280:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
103156	openSUSE Security Update : postgresql94 (openSUSE-2017-1020)	Nessus	SuSE Local Security Checks	2017/9/13	2025/11/21	critical
103244	Scientific Linux Security Update : postgresql on SL7.x x86_64 (20170914)	Nessus	Scientific Linux Local Security Checks	2017/9/15	2025/11/21	critical
103724	GLSA-201710-06 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/10/9	2025/11/19	critical
102490	Fedora 26 : postgresql (2017-d9cac37bd8)	Nessus	Fedora Local Security Checks	2017/8/15	2025/11/26	critical
290009	MiracleLinux 7 : rh-postgresql95-postgresql-9.5.9-1.el7 (AXSA:2017-2240:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical