The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0492 advisory.

    pgaudit     [1.7.0-1]
    - Initial import for postgresql 15 module
    - Update to 1.7.0
    - Support postgresql 15
    - Related: #2128410

    pg_repack     [1.4.8-2]
    - Add new build dependencies to fix build with lz4 enabled
    - Related: RHEL-47350

    [1.4.8-1]
    - Update to version 1.4.8
    - Postgresql 15 is supported
    - Related: #2128410

    postgres-decoderbufs     [1.9.7-1.Final]
    - Iitial import for postgresql 15 stream
    - Related: #2128410

    postgresql     [15.15-2]
    - Add sysusers configuration and generate tmpfiles.d dynamically
    - Resolves: RHEL-133896

    [15.15-1]
    - Update to 15.15
    - Resolves: RHEL-128813 (CVE-2025-12818)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 13 prior to 13.23, 14 prior to 14.20, 15 prior to 15.15, 16 prior to 16.11, 17 prior to 17.7, or 18 prior to 18.1. As such, it is potentially affected by multiple vulnerabilities:

  - Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input     provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of     megabytes. This results in a segmentation fault for the application using libpq. Versions before     PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12818)

  - Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of     service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the     same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1,     17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12817)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1300 advisory.

    Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of     service against other CREATE STATISTICS users by creating in any schema.  A later CREATE STATISTICS for     the same name, from a user having the CREATE privilege, would then fail.  Versions before PostgreSQL 18.1,     17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12817)

    Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input     provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of     megabytes.  This results in a segmentation fault for the application using libpq.  Versions before     PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12818)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1314 advisory.

    Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of     service against other CREATE STATISTICS users by creating in any schema.  A later CREATE STATISTICS for     the same name, from a user having the CREATE privilege, would then fail.  Versions before PostgreSQL 18.1,     17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12817)

    Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input     provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of     megabytes.  This results in a segmentation fault for the application using libpq.  Versions before     PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12818)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20131-1 advisory.

    Changes in postgresql17, postgresql18:

    Update to 17.7:

    * https://www.postgresql.org/about/news/p-3171/
    * https://www.postgresql.org/docs/release/17.7/

    * bsc#1253332, CVE-2025-12817: Missing check for CREATE       privileges on the schema in CREATE STATISTICS allowed table       owners to create statistics in any schema, potentially leading       to unexpected naming conflicts.
    * bsc#1253333, CVE-2025-12818: Several places in libpq were not       sufficiently careful about computing the required size of a       memory allocation. Sufficiently large inputs could cause       integer overflow, resulting in an undersized buffer, which       would then lead to writing past the end of the buffer.


    Postgresql is shipped in version 18.1.

    pgvector was updated to 0.8.1 to support postgresql18.

    pgaudit was updated to support postgresql18.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20194-1 advisory.

    Changes in postgresql17, postgresql18:

    Update to 17.7:

    * https://www.postgresql.org/about/news/p-3171/
    * https://www.postgresql.org/docs/release/17.7/

    * bsc#1253332, CVE-2025-12817: Missing check for CREATE       privileges on the schema in CREATE STATISTICS allowed table       owners to create statistics in any schema, potentially leading       to unexpected naming conflicts.
    * bsc#1253333, CVE-2025-12818: Several places in libpq were not       sufficiently careful about computing the required size of a       memory allocation. Sufficiently large inputs could cause       integer overflow, resulting in an undersized buffer, which       would then lead to writing past the end of the buffer.


    Postgresql is shipped in version 18.1.

    pgvector was updated to 0.8.1 to support postgresql18.

    pgaudit was updated to support postgresql18.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
286287	Oracle Linux 9 : postgresql:15 (ELSA-2026-0492)	Nessus	Oracle Linux Local Security Checks	2026/1/15	2026/2/24	medium
275842	PostgreSQL 13.x < 13.23 / 14.x < 14.20 / 15.x < 15.15 / 16.x < 16.11 / 17.x < 17.7 / 18.x < 18.1 Multiple Vulnerabilities	Nessus	Databases	2025/11/20	2026/2/24	medium
277797	Amazon Linux 2023 : postgresql17, postgresql17-contrib, postgresql17-llvmjit (ALAS2023-2025-1300)	Nessus	Amazon Linux Local Security Checks	2025/12/9	2026/2/24	medium
277801	Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2025-1314)	Nessus	Amazon Linux Local Security Checks	2025/12/9	2026/2/24	medium
297780	openSUSE 16 Security Update : postgresql17 and postgresql18 (openSUSE-SU-2026:20131-1)	Nessus	SuSE Local Security Checks	2026/2/4	2026/2/24	medium
297843	SUSE SLES16 Security Update : postgresql17 and postgresql18 (SUSE-SU-2026:20194-1)	Nessus	SuSE Local Security Checks	2026/2/4	2026/2/24	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium