The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7784 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7714 advisory.

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)
    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)
    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)
    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7884 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7885 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-464 advisory.

    Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory     from the end of the unknown-type value to the next zero byte. One typically gets an unknown-type value     via a string literal having no type designation. We have not confirmed or ruled out viability of attacks     that arrange for presence of notable, confidential information in disclosed bytes. (CVE-2023-5868)

    While modifying certain SQL array values, missing overflow checks let authenticated database users write     arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also     let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some     attacks of this description, but it missed others. (CVE-2023-5869)

    The documentation says the pg_cancel_backend role cannot signal a backend owned by a superuser. On the     contrary, it can signal background workers, including the logical replication launcher. It can signal     autovacuum workers and the autovacuum launcher. Signaling autovacuum workers and those two launchers     provides no meaningful exploit, so exploiting this vulnerability requires a non-core extension with a     less-resilient background worker. For example, a non-core background worker that does not auto-restart     would experience a denial of service with respect to that particular background worker. (CVE-2023-5870)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6538-2 advisory.

    USN-6538-1 fixed several vulnerabilities in PostgreSQL. This update provides the corresponding updates for     Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
186851	RHEL 9 : postgresql (RHSA-2023:7784)	Nessus	Red Hat Local Security Checks	2023/12/14	2024/11/7	high
186945	AlmaLinux 8 : postgresql:12 (ALSA-2023:7714)	Nessus	Alma Linux Local Security Checks	2023/12/15	2025/1/13	high
187125	RHEL 8 : postgresql:15 (RHSA-2023:7884)	Nessus	Red Hat Local Security Checks	2023/12/20	2024/11/7	high
187126	RHEL 9 : postgresql:15 (RHSA-2023:7885)	Nessus	Red Hat Local Security Checks	2023/12/20	2024/11/7	high
187687	Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2024-464)	Nessus	Amazon Linux Local Security Checks	2024/1/8	2024/12/11	high
189108	Ubuntu 18.04 ESM : PostgreSQL vulnerabilities (USN-6538-2)	Nessus	Ubuntu Local Security Checks	2024/1/17	2024/10/29	high

检测

插件搜索

high

high

high

high

high

high