PostgreSQL プロジェクトによる報告：

CVE-2018-10915:特定のホスト接続パラメーターはクライアントサイドのセキュリティ防御を突破します

他の接続ライブラリでも使用されるPostgreSQLのクライアント接続APIであるlibpqに、再接続を試行する際に接続状態変数のすべてをリセットしないという内部問題がありました。特に、接続にパスワードが必要かどうかを決定する状態変数がリセットされないため、「dblink」または「postgres_fdw」拡張などのlibpqを必要とする機能のユーザーが、アクセスが禁止されているサーバーにログインする可能性があります。

CVE-2018-10925:「INSERT ...ON CONFLICT DO UPDATE」でのメモリ漏洩と認証の欠如。

CREATE TABLEを発行できる攻撃者が、アップサート（「INSERT ...ON CONFLICT DO UPDATE」）クエリを使用するサーバーメモリの任意のバイトを読み取る可能性があります。デフォルトでは、すべてのユーザーがこれを悪用できます。特定のテーブルの少なくとも1つの列で特定のINSERT権限およびUPDATE権限を持つユーザーは、ビューおよびアップサートクエリを使用して他の列も更新できます。

9.6.10、CVE-2018-10915 CVE-2018-10925への更新

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

出典：Red Hatセキュリティアドバイザリ2018:2557：postgresqlの更新プログラムが、Red Hat Enterprise Linux 7で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響を重要度高として評価しています。詳細な重要度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。PostgreSQLは、高度なオブジェクトリレーショナルデータベース管理システム（DBMS）です。次のパッケージが新しいアップストリームバージョンにアップグレードされました：postgresql（9.2.24）（BZ#1612667）セキュリティ修正プログラム：* postgresql：特定のホスト接続パラメーターによるクライアント側のセキュリティ防御の無効化（CVE-2018-10915）影響、CVSSスコア、その他の関連情報を含むセキュリティの問題の詳細については、「参照」セクションに記載されているCVEのページを参照してください。Red Hatは、この問題を報告したPostgreSQLプロジェクトに感謝の意を表します。アップストリームは、Andrew Krasichkov氏を最初の報告者として認めています。

デフォルトのPostgreSQLクライアントライブラリであるlibpqに、接続間で内部状態をlibpqが適切にリセットできない脆弱性が見つかりました。影響を受けるlibpqのバージョンが、信頼できない入力の「host」または「hostaddr」接続パラメーターとともに使用される場合、攻撃者はPQescape()関数の不具合を引き起こすことでクライアント側の接続セキュリティ機能をバイパスし、より高度な権限がある接続へのアクセスを入手するか、SQLインジェクションを通じて別の影響を与える可能性があります。（CVE-2018-10915）

リモート Redhat Enterprise Linux 7 ホストに、RHSA-2018:3816 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - postgresql: pg_upgrade が、現在の umask で機密メタデータのファイルを作成します (CVE-2018-1053)

  - postgresql: pg_dump およびその他のクライアントアプリケーションにおける制御されない検索パス要素 (CVE-2018-1058)

  - postgresql: 特定のホスト接続パラメーターはクライアントサイドのセキュリティ防御を回避します (CVE-2018-10915)

  - postgresql: INSERT ... ON CONFLICT DO UPDATE ステートメントで承認とメモリ漏洩がありません (CVE-2018-10925)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

This update for postgresql96, postgresql10 and postgresql12 fixes the following issues :

postgresql10 was updated to 10.13 (bsc#1171924).

https://www.postgresql.org/about/news/2038/ https://www.postgresql.org/docs/10/release-10-13.html

postgresql10 was updated to 10.12 (CVE-2020-1720, bsc#1163985)

- https://www.postgresql.org/about/news/2011/

- https://www.postgresql.org/docs/10/release-10-12.html

postgresql10 was updated to 10.11 :

- https://www.postgresql.org/about/news/1994/

- https://www.postgresql.org/docs/10/release-10-11.html

postgresql12 was updated to 12.3 (bsc#1171924).

Bug Fixes and Improvements :

  - Several fixes for GENERATED columns, including an issue     where it was possible to crash or corrupt data in a     table when the output of the generated column was the     exact copy of a physical column on the table, e.g. if     the expression called a function which could return its     own input.

  - Several fixes for ALTER TABLE, including ensuring the     SET STORAGE directive is propagated to a table's     indexes.

  - Fix a potential race condition when using DROP OWNED BY     while another session is deleting the same objects.

  - Allow for a partition to be detached when it has     inherited ROW triggers.

  - Several fixes for REINDEX CONCURRENTLY, particularly     with issues when a REINDEX CONCURRENTLY operation fails.

  - Fix crash when COLLATE is applied to an uncollatable     type in a partition bound expression.

  - Fix performance regression in floating point     overflow/underflow detection.

  - Several fixes for full text search, particularly with     phrase searching.

  - Fix query-lifespan memory leak for a set-returning     function used in a query's FROM clause.

  - Several reporting fixes for the output of VACUUM     VERBOSE.

  - Allow input of type circle to accept the format (x,y),r,     which is specified in the documentation.

  - Allow for the get_bit() and set_bit() functions to not     fail on bytea strings longer than 256MB.

  - Avoid premature recycling of WAL segments during crash     recovery, which could lead to WAL segments being     recycled before being archived.

  - Avoid attempting to fetch nonexistent WAL files from     archive storage during recovery by skipping irrelevant     timelines.

  - Several fixes for logical replication and replication     slots.

  - Fix several race conditions in synchronous standby     management, including one that occurred when changing     the synchronous_standby_names setting.

  - Several fixes for GSSAPI support, include a fix for a     memory leak that occurred when using GSSAPI encryption.

  - Ensure that members of the pg_read_all_stats role can     read all statistics views.

  - Fix performance regression in     information_schema.triggers view.

  - Fix memory leak in libpq when using sslmode=verify-full.

  - Fix crash in psql when attempting to re-establish a     failed connection.

  - Allow tab-completion of the filename argument to \gx     command in psql.

  - Add pg_dump support for ALTER ... DEPENDS ON EXTENSION.

  - Several other fixes for pg_dump, which include dumping     comments on RLS policies and postponing restore of event     triggers until the end.

  - Ensure pg_basebackup generates valid tar files.

  - pg_checksums skips tablespace subdirectories that belong     to a different PostgreSQL major version

  - Several Windows compatibility fixes

This update also contains timezone tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.

For more details, check out :

  - https://www.postgresql.org/docs/12/release-12-3.html

Other fixes :

  - Let postgresqlXX conflict with postgresql-noarch <     12.0.1 to get a clean and complete cutover to the new     packaging schema.

postgresql96 was updated to 9.6.19 :

  - CVE-2020-14350, boo#1175194: Make contrib modules'     installation scripts more secure.

  - https://www.postgresql.org/docs/9.6/release-9-6-19.html

  - Pack the /usr/lib/postgresql symlink only into the main     package.

  - Let postgresqlXX conflict with postgresql-noarch <     12.0.1 to get a clean and complete cutover to the new     packaging schema.

  - update to 9.6.18 (boo#1171924).
    https://www.postgresql.org/about/news/2038/     https://www.postgresql.org/docs/9.6/release-9-6-18.html

  - Unify the spec file to work across all current     PostgreSQL versions to simplify future maintenance.

  - Move from the 'libs' build flavour to a 'mini' package     that will only be used inside the build service and not     get shipped, to avoid confusion with the debuginfo     packages (boo#1148643).

  - update to 9.6.17 (CVE-2020-1720, boo#1163985)     https://www.postgresql.org/about/news/2011/     https://www.postgresql.org/docs/9.6/release-9-6-17.html

  - use and package the sha256 checksum for for source

  - update to 9.6.16:
    https://www.postgresql.org/about/news/1994/     https://www.postgresql.org/docs/9.6/release-9-6-16.html

  - add requires to the devel package for the libs that are     returned by pg_config --libs

  - Update to 9.6.15 :

  - https://www.postgresql.org/about/news/1960/

  - https://www.postgresql.org/docs/9.6/release-9-6-15.html

  - CVE-2019-10208, boo#1145092: TYPE in pg_temp executes     arbitrary SQL during SECURITY DEFINER execution.

  - Use FAT LTO objects in order to provide proper static     library.

  - Update to 9.6.14:
    https://www.postgresql.org/docs/9.6/release-9-6-14.html

  - Update to 9.6.13 :

  - https://www.postgresql.org/docs/9.6/release-9-6-13.html

  - https://www.postgresql.org/about/news/1939/

  - CVE-2019-10130, boo#1134689: Prevent row-level security     policies from being bypassed via selectivity estimators.

  - Make the server-devel package exclusive across versions.

  - Update to 9.6.12 :

  - https://www.postgresql.org/docs/9.6/release-9-6-12.html

  - https://www.postgresql.org/about/news/1920/

  - By default, panic instead of retrying after fsync()     failure, to avoid possible data corruption.

  - Numerous other bug fixes.

  - Overhaul README.SUSE

  - Update to 9.6.11 :

  - Numerous bug fixes, see the release notes:
    https://www.postgresql.org/docs/9.6/release-9-6-11.html

  - Remove unneeded library dependencies from PGXS.

  - add provides for the new server-devel package that will     be introduced in postgresql 11

  - Update to 9.6.10:
    https://www.postgresql.org/docs/current/static/release-9
    -6-10.html

  - CVE-2018-10915, boo#1104199: Fix failure to reset     libpq's state fully between connection attempts.

  - CVE-2018-10925, boo#1104202: Fix INSERT ... ON CONFLICT     UPDATE through a view that isn't just SELECT * FROM ...

  - Update to 9.6.9:
    https://www.postgresql.org/about/news/1851/     https://www.postgresql.org/docs/current/static/release-9
    -6-9.html A dump/restore is not required for those     running 9.6.X. However, if you use the adminpack     extension, you should update it as per the first     changelog entry below. Also, if the function marking     mistakes mentioned in the second and third changelog     entries below affect you, you will want to take steps to     correct your database catalogs.

  - CVE-2018-1115, boo#1091610: Remove public execute     privilege from contrib/adminpack's pg_logfile_rotate()     function pg_logfile_rotate() is a deprecated wrapper for     the core function pg_rotate_logfile(). When that     function was changed to rely on SQL privileges for     access control rather than a hard-coded superuser check,     pg_logfile_rotate() should have been updated as well,     but the need for this was missed. Hence, if adminpack is     installed, any user could request a logfile rotation,     creating a minor security issue. After installing this     update, administrators should update adminpack by     performing ALTER EXTENSION adminpack UPDATE in each     database in which adminpack is installed.

  - Fix incorrect volatility markings on a few built-in     functions

  - Fix incorrect parallel-safety markings on a few built-in     functions.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

An update of the postgresql package has been released.

An unprivileged user of dblink or postgres_fdw could bypass the checks intended to prevent use of server-side credentials, such as a ~/.pgpass file owned by the operating-system user running the server.
Servers allowing peer authentication on local connections are particularly vulnerable. Other attacks such as SQL injection into a postgres_fdw session are also possible. Attacking postgres_fdw in this way requires the ability to create a foreign server object with selected connection parameters, but any user with access to dblink could exploit the problem. In general, an attacker with the ability to select the connection parameters for a libpq-using application could cause mischief, though other plausible attack scenarios are harder to think of. Our thanks to Andrew Krasichkov for reporting this issue.

For Debian 8 'Jessie', this problem has been fixed in version 9.4.19-0+deb8u1.

We recommend that you upgrade your postgresql-9.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2643 advisory.

    The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization     Manager. The appliance is available to download as an OVA file from the Customer Portal.

    The following packages have been upgraded to a later upstream version: rhvm-appliance (4.2). (BZ#1590658,     BZ#1591095, BZ#1591096, BZ#1592655, BZ#1594636, BZ#1597534, BZ#1612683)

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915 and Ammarit Thongthua     (Deloitte Thailand Pentest team) and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting     CVE-2018-1067. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915.

    Security fixes:

    * vulnerability: wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary     files (Zip Slip) (CVE-2018-10862)

    * vulnerability: apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*     (CVE-2018-8039)

    * vulnerability: postgresql: Certain host connection parameters defeat client-side security defenses     (CVE-2018-10915)

    * vulnerability: undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of )     (CVE-2018-1067, CVE-2016-4993)

    * vulnerability: undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows     attacker to cause a denial of service (CVE-2018-1114)

    * vulnerability: guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes     allow remote attackers to cause a denial of service (CVE-2018-10237)

    * vulnerability: bouncycastle: flaw in the low-level interface to RSA key pair generator     (CVE-2018-1000180)

    For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other     related information, refer to the CVE pages listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction.(CVE-2018-10915)

It was discovered that PostgreSQL failed to properly check authorization on certain statements involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE TABLE' privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain 'INSERT' and limited 'UPDATE' privileges to a particular table, they could exploit this to update other columns in the same table.(CVE-2018-10925)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - postgresql: Certain host connection parameters defeat     client-side security defenses (CVE-2018-10915)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.24, 9.4.x prior to 9.4.19, 9.5.x prior to 9.5.14, 9.6.x prior to 9.6.10, or 10.x prior to 10.5. It is, therefore, affected by multiple vulnerabilities.

The following packages have been upgraded to a later upstream version:
postgresql (9.2.24).

Security Fix(es) :

  - postgresql: Certain host connection parameters defeat     client-side security defenses (CVE-2018-10915)

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq were used with 'host' or 'hostaddr' connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction.(CVE-2018-10915)

It was discovered that PostgreSQL failed to properly check authorization on certain statements involved with 'INSERT ... ON CONFLICT DO UPDATE'. An attacker with 'CREATE TABLE' privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain 'INSERT' and limited 'UPDATE' privileges to a particular table, they could exploit this to update other columns in the same table.(CVE-2018-10925)

It was found that pg_catalog.pg_logfile_rotate(), from the adminpack extension, did not follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could use this flaw to force log rotation.(CVE-2018-1115 )

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2565 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql10-postgresql (10.5).
    (BZ#1612673, BZ#1614337)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges     Andrew Krasichkov as the original reporter of CVE-2018-10915; and Stephen Frost as the original reporter     of CVE-2018-1115.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
111656	FreeBSD：PostgreSQL -- 2つの脆弱性（96eab874-9c79-11e8-b34b-6cc21735f730）	Nessus	FreeBSD Local Security Checks	2018/8/13	2024/8/22	high
111770	Fedora 27：postgresql（2018-d8f5aea89d）	Nessus	Fedora Local Security Checks	2018/8/16	2024/8/21	high
112103	Oracle Linux 7：postgresql（ELSA-2018-2557）	Nessus	Oracle Linux Local Security Checks	2018/8/24	2025/3/26	high
117709	Amazon Linux 2：postgresql（ALAS-2018-1080）	Nessus	Amazon Linux Local Security Checks	2018/9/27	2025/3/25	high
194110	RHEL 7 : CloudForms 4.6.6 (RHSA-2018:3816)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/6/3	high
139655	openSUSE Security Update : postgresql96 / postgresql10 and postgresql12 (openSUSE-2020-1227)	Nessus	SuSE Local Security Checks	2020/8/18	2024/2/26	critical
121879	Photon OS 1.0: Postgresql PHSA-2018-1.0-0178	Nessus	PhotonOS Local Security Checks	2019/2/7	2022/5/23	high
111762	Debian DLA-1464-1 : postgresql-9.4 security update	Nessus	Debian Local Security Checks	2018/8/16	2025/3/26	high
117324	RHEL 7 : rhvm-appliance (RHSA-2018:2643)	Nessus	Red Hat Local Security Checks	2018/9/6	2025/4/29	high
117346	Amazon Linux AMI : postgresql96 (ALAS-2018-1074)	Nessus	Amazon Linux Local Security Checks	2018/9/7	2024/8/9	high
117754	EulerOS 2.0 SP2 : postgresql (EulerOS-SA-2018-1311)	Nessus	Huawei Local Security Checks	2018/9/27	2025/3/25	high
111966	PostgreSQL 9.3.x < 9.3.24 / 9.4.x < 9.4.19 / 9.5.x < 9.5.14 / 9.6.x < 9.6.10 / 10.x < 10.5 Multiple Vulnerabilities	Nessus	Databases	2018/8/17	2025/2/5	high
112105	Scientific Linux Security Update : postgresql on SL7.x x86_64 (20180823)	Nessus	Scientific Linux Local Security Checks	2018/8/24	2025/3/26	high
119478	Amazon Linux AMI : postgresql96 (ALAS-2018-1119)	Nessus	Amazon Linux Local Security Checks	2018/12/7	2024/7/17	critical
194127	RHEL 7 : rh-postgresql10-postgresql (RHSA-2018:2565)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/4/15	critical

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high

high

high

high

critical

critical