The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2243:02 advisory.

    * It was found that authenticating to a PostgreSQL database account with an     empty password was possible despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain access to database     accounts with empty passwords. (CVE-2017-7546)
      * An authorization flaw was found in the way PostgreSQL handled access to the     pg_user_mappings view on foreign servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the user mappings defined     by the foreign server owners without actually having the privileges to do so.
    (CVE-2017-7547)     Asianux would like to thank the PostgreSQL project for reporting these issues.
    Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as     the original reporters of CVE-2017-7546; and Jeff Janes as the original     reporter of CVE-2017-7547.
    CVE-2017-7546     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to incorrect authentication flaw allowing remote attackers     to gain access to database accounts with an empty password.
    CVE-2017-7547     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to authorization flaw allowing remote authenticated     attackers to retrieve passwords from the user mappings defined by the     foreign server owners without actually having the privileges to do so.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql95 fixes the following issues :

Upate to PostgreSQL 9.5.11 :

Security issues fixed :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-11.html 

  - CVE-2018-1053, boo#1077983: Ensure that all temporary     files made by pg_upgrade are non-world-readable. 

  - boo#1079757: Rename pg_rewind's copy_file_range function     to avoid conflict with new Linux system call of that     name.

In version 9.5.10 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-10.html

  - CVE-2017-15098, boo#1067844: Memory disclosure in JSON     functions.

  - CVE-2017-15099, boo#1067841: INSERT ... ON CONFLICT DO     UPDATE fails to enforce SELECT privileges.

In version 9.5.9 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-9.html

  - Show foreign tables in     information_schema.table_privileges view.

  - Clean up handling of a fatal exit (e.g., due to receipt     of SIGTERM) that occurs while trying to execute a     ROLLBACK of a failed transaction.

  - Remove assertion that could trigger during a fatal exit.

  - Correctly identify columns that are of a range type or     domain type over a composite type or domain type being     searched for.

  - Fix crash in pg_restore when using parallel mode and     using a list file to select a subset of items to     restore.

  - Change ecpg's parser to allow RETURNING clauses without     attached C variables.

In version 9.5.8

  - https://www.postgresql.org/docs/9.5/static/release-9-5-8.html

  - CVE-2017-7547, boo#1051685: Further restrict visibility     of pg_user_mappings.umoptions, to protect passwords     stored as user mapping options.

  - CVE-2017-7546, boo#1051684: Disallow empty passwords in     all password-based authentication methods.

  - CVE-2017-7548, boo#1053259: lo_put() function ignores     ACLs.

Several vulnerabilities have been found in the PostgreSQL database system :

CVE-2017-7486

Andrew Wheelwright discovered that user mappings were insufficiently restricted.

CVE-2017-7546

In some authentication methods empty passwords were accepted.

CVE-2017-7547

User mappings could leak data to unprivileged users.

For Debian 7 'Wheezy', these problems have been fixed in version 9.1.24lts2-0+deb7u1.

We recommend that you upgrade your postgresql-9.1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Postgresql93 was updated to 9.3.18 to fix the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

The changelog for the release is here :

&#9;https://www.postgresql.org/docs/9.3/static/release-9-3-18.html

This update was imported from the SUSE:SLE-12:Update update project.

An update for postgresql is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version:
postgresql (9.2.23). (BZ#1484639, BZ#1484647)

Security Fix(es) :

* It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)

* An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. (CVE-2017-7547)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; and Jeff Janes as the original reporter of CVE-2017-7547.

The pg_user_mappings view discloses passwords to users lacking server privileges :

An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. (CVE-2017-7547)

Empty password accepted in some authentication methods :

It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2677 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.9).
    (BZ#1484637, BZ#1484642, BZ#1484648)

    Security Fix(es):

    * It was found that authenticating to a PostgreSQL database account with an empty password was possible     despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to     gain access to database accounts with empty passwords. (CVE-2017-7546)

    * An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on     foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords     from the user mappings defined by the foreign server owners without actually having the privileges to do     so. (CVE-2017-7547)

    * An authorization flaw was found in the way PostgreSQL handled large objects. A remote, authenticated     attacker with no privileges on a large object could potentially use this flaw to overwrite the entire     content of the object, thus resulting in denial of service. (CVE-2017-7548)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben     de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; Jeff Janes as     the original reporter of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2280:02 advisory.

    * It was found that authenticating to a PostgreSQL database account with an     empty password was possible despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain access to database     accounts with empty passwords. (CVE-2017-7546)
      * An authorization flaw was found in the way PostgreSQL handled access to the     pg_user_mappings view on foreign servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the user mappings defined     by the foreign server owners without actually having the privileges to do so.
    (CVE-2017-7547)
      * An authorization flaw was found in the way PostgreSQL handled large objects.
    A remote, authenticated attacker with no privileges on a large object could     potentially use this flaw to overwrite the entire content of the object, thus     resulting in denial of service. (CVE-2017-7548)     Asianux would like to thank the PostgreSQL project for reporting these issues.
    Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as     the original reporters of CVE-2017-7546; Jeff Janes as the original reporter     of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.
    CVE-2017-7546     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to incorrect authentication flaw allowing remote attackers     to gain access to database accounts with an empty password.
    CVE-2017-7547     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to authorization flaw allowing remote authenticated     attackers to retrieve passwords from the user mappings defined by the     foreign server owners without actually having the privileges to do so.
    CVE-2017-7548     PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to     authorization flaw allowing remote authenticated attackers with no     privileges on a large object to overwrite the entire contents of the     object, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2241:02 advisory.

    * It was found that authenticating to a PostgreSQL database account with an     empty password was possible despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain access to database     accounts with empty passwords. (CVE-2017-7546)
      * An authorization flaw was found in the way PostgreSQL handled access to the     pg_user_mappings view on foreign servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the user mappings defined     by the foreign server owners without actually having the privileges to do so.
    (CVE-2017-7547)
      * An authorization flaw was found in the way PostgreSQL handled large objects.
    A remote, authenticated attacker with no privileges on a large object could     potentially use this flaw to overwrite the entire content of the object, thus     resulting in denial of service. (CVE-2017-7548)     Asianux would like to thank the PostgreSQL project for reporting these issues.
    Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as     the original reporters of CVE-2017-7546; Jeff Janes as the original reporter     of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.
    CVE-2017-7546     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to incorrect authentication flaw allowing remote attackers     to gain access to database accounts with an empty password.
    CVE-2017-7547     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to authorization flaw allowing remote authenticated     attackers to retrieve passwords from the user mappings defined by the     foreign server owners without actually having the privileges to do so.
    CVE-2017-7548     PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to     authorization flaw allowing remote authenticated attackers with no     privileges on a large object to overwrite the entire contents of the     object, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PostgreSQL project reports :

- CVE-2017-7546: Empty password accepted in some authentication methods

- CVE-2017-7547: The 'pg_user_mappings' catalog view discloses passwords to users lacking server privileges

- CVE-2017-7548: lo_put() function ignores ACLs

Several vulnerabilities have been found in the PostgreSQL database system :

  - CVE-2017-7546     In some authentication methods empty passwords were     accepted.

  - CVE-2017-7547     User mappings could leak data to unprivileged users.

  - CVE-2017-7548     The lo_put() function ignored ACLs.

  For more in-depth descriptions of the security vulnerabilities,   please see https://www.postgresql.org/about/news/1772/

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3390-1 advisory.

    Ben de Graaff, Jelte Fennema, and Jeroen van der Ham discovered that PostgreSQL allowed the use of empty     passwords in some authentication methods, contrary to expected behaviour. A remote attacker could use an     empty password to authenticate to servers that were believed to have password login disabled.
    (CVE-2017-7546)

    Jeff Janes discovered that PostgreSQL incorrectly handled the pg_user_mappings catalog view. A remote     attacker without server privileges could possibly use this issue to obtain certain passwords.
    (CVE-2017-7547)

    Chapman Flack discovered that PostgreSQL incorrectly handled lo_put() permissions. A remote attacker could     possibly use this issue to change the data in a large object. (CVE-2017-7548)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql96 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

The changelog for this release is here:
&#9;https://www.postgresql.org/docs/9.6/static/release-9-6-4.html

This update was imported from the SUSE:SLE-12:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2728 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (9.2.23). (BZ#1484639,     BZ#1484647)

    Security Fix(es):

    * It was found that authenticating to a PostgreSQL database account with an empty password was possible     despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to     gain access to database accounts with empty passwords. (CVE-2017-7546)

    * An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on     foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords     from the user mappings defined by the foreign server owners without actually having the privileges to do     so. (CVE-2017-7547)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben     de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; and Jeff     Janes as the original reporter of CVE-2017-7547.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2728 advisory.

    [9.2.23-1]
    - update to 9.2.23 per release notes       http://www.postgresql.org/docs/9.2/static/release-9-2-23.html

    [9.2.22-1]
    - update to 9.2.22 per release notes       http://www.postgresql.org/docs/9.2/static/release-9-2-22.html

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2281:02 advisory.

    * It was found that authenticating to a PostgreSQL database account with an     empty password was possible despite libpq's refusal to send an empty password. A     remote attacker could potentially use this flaw to gain access to database     accounts with empty passwords. (CVE-2017-7546)
      * An authorization flaw was found in the way PostgreSQL handled access to the     pg_user_mappings view on foreign servers. A remote, authenticated attacker could     potentially use this flaw to retrieve passwords from the user mappings defined     by the foreign server owners without actually having the privileges to do so.
    (CVE-2017-7547)
      * An authorization flaw was found in the way PostgreSQL handled large objects.
    A remote, authenticated attacker with no privileges on a large object could     potentially use this flaw to overwrite the entire content of the object, thus     resulting in denial of service. (CVE-2017-7548)     Asianux would like to thank the PostgreSQL project for reporting these issues.
    Upstream acknowledges Ben de Graaff, Jelte Fennema, and Jeroen van der Ham as     the original reporters of CVE-2017-7546; Jeff Janes as the original reporter     of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.
    CVE-2017-7546     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to incorrect authentication flaw allowing remote attackers     to gain access to database accounts with an empty password.
    CVE-2017-7547     PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are     vulnerable to authorization flaw allowing remote authenticated     attackers to retrieve passwords from the user mappings defined by the     foreign server owners without actually having the privileges to do so.
    CVE-2017-7548     PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to     authorization flaw allowing remote authenticated attackers with no     privileges on a large object to overwrite the entire contents of the     object, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
291572	MiracleLinux 7 : postgresql-9.2.23-1.el7 (AXSA:2017-2243:02)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
106965	openSUSE Security Update : postgresql95 (openSUSE-2018-204)	Nessus	SuSE Local Security Checks	2018/2/23	2025/10/29	critical
102368	Debian DLA-1051-1 : postgresql-9.1 security update	Nessus	Debian Local Security Checks	2017/8/11	2025/12/2	critical
102847	openSUSE Security Update : postgresql93 (openSUSE-2017-985)	Nessus	SuSE Local Security Checks	2017/8/31	2025/11/25	critical
103230	CentOS 7 : postgresql (CESA-2017:2728)	Nessus	CentOS Local Security Checks	2017/9/15	2021/1/4	critical
103755	Amazon Linux AMI : postgresql96 (ALAS-2017-908)	Nessus	Amazon Linux Local Security Checks	2017/10/11	2025/11/19	critical
210267	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2017:2677)	Nessus	Red Hat Local Security Checks	2024/11/5	2024/11/5	critical
289148	MiracleLinux 4 : rh-postgresql95-postgresql-9.5.9-1.AXS4 (AXSA:2017-2280:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
289654	MiracleLinux 7 : rh-postgresql94-postgresql-9.4.14-1.el7 (AXSA:2017-2241:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
102408	FreeBSD : PostgreSQL vulnerabilities (982872f1-7dd3-11e7-9736-6cc21735f730)	Nessus	FreeBSD Local Security Checks	2017/8/11	2025/12/2	critical
102442	Debian DSA-3935-1 : postgresql-9.4 - security update	Nessus	Debian Local Security Checks	2017/8/14	2025/12/2	critical
102522	Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerabilities (USN-3390-1)	Nessus	Ubuntu Local Security Checks	2017/8/16	2024/8/27	critical
103157	openSUSE Security Update : postgresql96 (openSUSE-2017-1021)	Nessus	SuSE Local Security Checks	2017/9/13	2025/11/21	critical
103209	RHEL 7 : postgresql (RHSA-2017:2728)	Nessus	Red Hat Local Security Checks	2017/9/14	2025/4/15	critical
103238	Oracle Linux 7 : postgresql (ELSA-2017-2728)	Nessus	Oracle Linux Local Security Checks	2017/9/15	2024/11/1	critical
289686	MiracleLinux 4 : rh-postgresql94-postgresql-9.4.14-1.AXS4 (AXSA:2017-2281:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical