The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2198-1 advisory.

    Updated to version 12.15:
      - CVE-2023-2454: Fixed an issue where a user having permission to         create a schema could hijack the privileges of a security definer         function or extension script (bsc#1211228).
      - CVE-2023-2455: Fixed an issue that could allow a user to see or         modify rows that should have been invisible (bsc#1211229).
      - Internal fixes (bsc#1210303).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2206-1 advisory.

    Updated to version 15.3:
      - CVE-2023-2454: Fixed an issue where a user having permission to         create a schema could hijack the privileges of a security definer         function or extension script (bsc#1211228).
      - CVE-2023-2455: Fixed an issue that could allow a user to see or         modify rows that should have been invisible (bsc#1211229).
      - Internal fixes (bsc#1210303).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2202-1 advisory.

    Updated to version 14.8:
      - CVE-2023-2454: Fixed an issue where a user having permission to         create a schema could hijack the privileges of a security definer         function or extension script (bsc#1211228).
      - CVE-2023-2455: Fixed an issue that could allow a user to see or         modify rows that should have been invisible (bsc#1211229).
      - Internal fixes (bsc#1210303).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3714 advisory.

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4535 advisory.

  - In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes. (CVE-2022-41862)

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4527 advisory.

    pgaudit     pg_repack     postgres-decoderbufs

    postgresql     [13.11-1.0.1]
    - Update to 13.11
    - Resolves: #2212815
    - Update postgresql-setup to 8.7 (https://github.com/devexp-db/postgresql-setup/pull/35)
    - Resolves: #2207933
    - Update 1001-Fixed-postgresql-service-network-binding-issue.patch for postgresql-setup

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4535 advisory.

    pgaudit     pg_repack     postgres-decoderbufs

    postgresql     [12.15-1.0.1]
    - Fixed postgresql port binding issue during bootup [Orabug: 35103668]

    [12.15-1]
    - Update postgresql-setup to 8.7 (https://github.com/devexp-db/postgresql-setup/pull/35)
    - Resolves: #2207932
    - Update to version 12.15

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote host is prior to 12.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-001 advisory.

    postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)

    This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap     superuser. Database owners have that right by default, and explicit grants may extend it to other users.
    (CVE-2023-2454)

    While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario     involving function inlining. This leads to potentially incorrect policies being applied in cases where     role-specific policies are used and a given query is planned under one role and then executed under other     roles. This scenario can happen under security definer functions or when a common user and query is     planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a     user to complete otherwise-forbidden reads and modifications. This affects only databases that have used     CREATE POLICY to define a row security policy. (CVE-2023-2455)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:4527 advisory.

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the postgresql14 package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
175802	SUSE SLES15: libecpg6 / libpq5 / libpq5-32bit / postgresql12 / etc (SUSE-SU-2023:2198-1)	Nessus	SuSE Local Security Checks	2023/5/16	2026/6/25	high
175807	SUSE SLES12: libecpg6 / libecpg6-32bit / libpq5 / libpq5-32bit / postgresql15 / etc (SUSE-SU-2023:2206-1)	Nessus	SuSE Local Security Checks	2023/5/16	2026/6/25	high
175814	SUSE SLES12: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (SUSE-SU-2023:2202-1)	Nessus	SuSE Local Security Checks	2023/5/16	2026/6/25	high
177626	AlmaLinux 9 : postgresql (ALSA-2023:3714)	Nessus	Alma Linux Local Security Checks	2023/6/26	2023/8/17	high
179463	CentOS 8 : postgresql:12 (CESA-2023:4535)	Nessus	CentOS Local Security Checks	2023/8/8	2024/2/8	high
179848	Oracle Linux 8 : postgresql:13 (ELSA-2023-4527)	Nessus	Oracle Linux Local Security Checks	2023/8/15	2025/9/9	high
179863	Oracle Linux 8 : postgresql:12 (ELSA-2023-4535)	Nessus	Oracle Linux Local Security Checks	2023/8/15	2025/9/9	high
181979	Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-001)	Nessus	Amazon Linux Local Security Checks	2023/9/27	2024/12/11	high
182723	Rocky Linux 8 : postgresql:13 (RLSA-2023:4527)	Nessus	Rocky Linux Local Security Checks	2023/10/6	2023/11/6	high
203485	Photon OS 4.0: Postgresql14 PHSA-2023-4.0-0394	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
251595	Linux Distros Unpatched Vulnerability : CVE-2023-2454	Nessus	Misc.	2025/8/18	2026/8/4	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high