The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2024_6020 advisory.

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5927 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0774 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-4317:
    A flaw was found in PostgreSQL. Missing authorization in the built-in views pg_stats_ext and     pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics     from CREATE STATISTICS commands of other users. The most common values may reveal column values the     eavesdropper could not otherwise read or results of functions they cannot execute.

    CVE-2024-7348:
    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack     involves replacing another relation type with a view or foreign table. The attack requires waiting for     pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction.
    Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0642 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-4317:
    Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values may reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1768-1 advisory.

    PostgreSQL upgrade to version 14.12 (bsc#1224051):

    - CVE-2024-4317: Fixed visibility restriction of pg_stats_ext and pg_stats_ext_exprs entries to the table     owner (bsc#1224038).

    Bug fixes:

    - Fix incompatibility with LLVM 18.
    - Prepare for PostgreSQL 17.
    - Make sure all compilation and doc generation happens in %build.
    - Require LLVM <= 17 for now, because LLVM 18 doesn't seem to work.
    - Remove constraints file because improved memory usage for s390x
    - Use %patch -P N instead of deprecated %patchN.

    Release notes:

    - https://www.postgresql.org/docs/release/14.12/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2266-1 advisory.

    PostgreSQL upgrade to version 16.3 (bsc#1224051):

    - CVE-2024-4317: Fixed visibility restriction of pg_stats_ext and pg_stats_ext_exprs entries to the table     owner (bsc#1224038).

    Bug fixes:

    - Fix incompatibility with LLVM 18.
    - Prepare for PostgreSQL 17.
    - Make sure all compilation and doc generation happens in %build.
    - Require LLVM <= 17 for now, because LLVM 18 doesn't seem to work.
    - Remove constraints file because improved memory usage for s390x
    - Use %patch -P N instead of deprecated %patchN.

    Release notes:

    - https://www.postgresql.org/docs/release/16.3/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4317 advisory.

  - Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an     unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands     of other users. The most common values May reveal column values the eavesdropper could not otherwise read     or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL     installations, namely those that are created with the initdb utility after installing that version.
    Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release     notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected.
    Versions before PostgreSQL 14 are unaffected. (CVE-2024-4317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5929 advisory.

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)
    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6020 advisory.

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)
    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5927 advisory.

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
356130	Rocky Linux 9 [CIQ] Security Update: pgaudit / pgaudit-debuginfo / pgaudit-debugsource / etc Multiple Vulnerabilities (crlsa-2024_6020)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
210512	RHEL 8 : postgresql:16 (RHSA-2024:5927)	Nessus	Red Hat Local Security Checks	2024/11/7	2025/3/26	high
238508	TencentOS Server 3: postgresql:15 (TSSA-2024:0774)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high
239056	TencentOS Server 4: postgresql16 (TSSA-2024:0642)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	medium
197891	SUSE SLES15: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (SUSE-SU-2024:1768-1)	Nessus	SuSE Local Security Checks	2024/5/24	2026/6/26	medium
201331	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postgresql16 (SUSE-SU-2024:2266-1)	Nessus	SuSE Local Security Checks	2024/7/3	2025/2/13	medium
201691	CBL Mariner 2.0 Security Update: postgresql (CVE-2024-4317)	Nessus	MarinerOS Local Security Checks	2024/7/3	2025/2/14	medium
206315	AlmaLinux 9 : postgresql:16 (ALSA-2024:5929)	Nessus	Alma Linux Local Security Checks	2024/8/29	2025/1/13	high
206336	AlmaLinux 9 : postgresql:15 (ALSA-2024:6020)	Nessus	Alma Linux Local Security Checks	2024/8/30	2025/1/13	high
207301	Rocky Linux 8 : postgresql:16 (RLSA-2024:5927)	Nessus	Rocky Linux Local Security Checks	2024/9/16	2024/11/22	high

检测

插件搜索

high

high

high

medium

medium

medium

medium

high

high

high