遠端 Redhat Enterprise Linux 9 主機上安裝的多個套件受到 RHSA-2024:6020 公告中提及的多個弱點影響。

    PostgreSQL 是一種進階物件關聯式資料庫管理系統 (DBMS)。

    安全性修正：

    * postgresql：pg_dump 執行任意 SQL 期間的 PostgreSQL 關係取代 (CVE-2024-7348)

    * postgresql：PostgreSQL pg_stats_ext 和 pg_stats_ext_exprs 缺少授權檢查 (CVE-2024-4317)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2024:5927 公告中提及的多個弱點影響。

    PostgreSQL 是一種進階物件關聯式資料庫管理系統 (DBMS)。

    安全性修正：

    * postgresql：PostgreSQL pg_stats_ext 和 pg_stats_ext_exprs 缺少授權檢查 (CVE-2024-4317)

    * postgresql：pg_dump 執行任意 SQL 期間的 PostgreSQL 關係取代 (CVE-2024-7348)

    如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2024:6142 公告中提及的多個弱點影響。

    PostgreSQL 是一種進階物件關聯式資料庫管理系統 (DBMS)。

    安全性修正：

    * postgresql：PostgreSQL pg_stats_ext 和 pg_stats_ext_exprs 缺少授權檢查 (CVE-2024-4317)

    * postgresql：pg_dump 執行任意 SQL 期間的 PostgreSQL 關係取代 (CVE-2024-7348)

    如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 AlmaLinux 9 主機已安裝受到多個弱點影響的套件如 ALSA-2024:5929 公告中所提及。

    * postgresql：PostgreSQL pg_stats_ext 和 pg_stats_ext_exprs 缺少授權檢查 (CVE-2024-4317)
    * postgresql：pg_dump 執行任意 SQL 期間的 PostgreSQL 關係取代 (CVE-2024-7348)

Tenable 已直接從 AlmaLinux 安全性公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote host is affected by the vulnerability described in GLSA-202408-06 (PostgreSQL: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2262-2 advisory.

    - Upgrade to 14.12 (bsc#1224051):
    - CVE-2024-4317: Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner.
    See release notes for the steps that have to be taken to fix existing PostgreSQL instances. (bsc#1224038)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1651-1 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values may reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1703-1 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values may reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 14 prior to 14.12, 15 prior to 15.7, or 16 prior to 16.3. As such, it is potentially affected by a vulnerability :

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS     commands of other users. The most common values may reveal column values the eavesdropper could not     otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes     fresh PostgreSQL installations, namely those that are created with the initdb utility after installing     that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions     in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and     14.12 are affected. Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4317 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values May reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5929 advisory.

    pgaudit     pg_repack     postgres-decoderbufs     postgresql     [16.4-1]
    - Update to 16.4

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6020 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5927 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6142 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5929 advisory.

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)
    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
210489	RHEL 9：postgresql:15 (RHSA-2024:6020)	Nessus	Red Hat Local Security Checks	2024/11/7	2025/3/26	high
210512	RHEL 8：postgresql:16 (RHSA-2024:5927)	Nessus	Red Hat Local Security Checks	2024/11/7	2025/3/26	high
210547	RHEL 8：postgresql:15 (RHSA-2024:6142)	Nessus	Red Hat Local Security Checks	2024/11/7	2024/11/7	high
206315	AlmaLinux 9 : postgresql:16 (ALSA-2024:5929)	Nessus	Alma Linux Local Security Checks	2024/8/29	2025/1/13	high
205136	GLSA-202408-06 : PostgreSQL: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/8/7	2024/8/7	high
204738	SUSE SLES15 Security Update : postgresql14 (SUSE-SU-2024:2262-2)	Nessus	SuSE Local Security Checks	2024/7/25	2025/2/13	medium
197175	SUSE SLES12 Security Update : postgresql16 (SUSE-SU-2024:1651-1)	Nessus	SuSE Local Security Checks	2024/5/16	2025/2/13	medium
197549	SUSE SLES12 Security Update : postgresql14 (SUSE-SU-2024:1703-1)	Nessus	SuSE Local Security Checks	2024/5/21	2025/2/13	medium
197741	PostgreSQL 14.x < 14.12 / 15.x < 15.7 / 16.x < 16.3 Missing Authorization Check	Nessus	Databases	2024/5/23	2025/5/29	medium
216288	Azure Linux 3.0 Security Update: postgresql (CVE-2024-4317)	Nessus	Azure Linux Local Security Checks	2025/2/14	2025/2/14	medium
206312	Oracle Linux 9 : postgresql:16 (ELSA-2024-5929)	Nessus	Oracle Linux Local Security Checks	2024/8/29	2024/11/22	high
210489	RHEL 9 : postgresql:15 (RHSA-2024:6020)	Nessus	Red Hat Local Security Checks	2024/11/7	2025/3/26	high
210512	RHEL 8 : postgresql:16 (RHSA-2024:5927)	Nessus	Red Hat Local Security Checks	2024/11/7	2025/3/26	high
210547	RHEL 8 : postgresql:15 (RHSA-2024:6142)	Nessus	Red Hat Local Security Checks	2024/11/7	2024/11/7	high
206315	AlmaLinux 9 : postgresql:16 (ALSA-2024:5929)	Nessus	Alma Linux Local Security Checks	2024/8/29	2025/1/13	high

检测

插件搜索

high

high

high

high

high

medium

medium

medium

medium

medium

high

high

high

high

high