The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5927 advisory.

    * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317)

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote host is prior to 13.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-007 advisory.

    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack     involves replacing another relation type with a view or foreign table. The attack requires waiting for     pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction.
    Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. (CVE-2024-7348)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 12 prior to 12.20, 13 prior to 13.16, 14 prior to 14.13, 15 prior to 15.8, or 16 prior to 16.4. As such, it is potentially affected by a vulnerability :

  - Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack     involves replacing another relation type with a view or foreign table. The attack requires waiting for     pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction.
    Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. (CVE-2024-7348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6140 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0736 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2024-7348:
    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack     involves replacing another relation type with a view or foreign table. The attack requires waiting for     pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction.
    Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0774 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-4317:
    A flaw was found in PostgreSQL. Missing authorization in the built-in views pg_stats_ext and     pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics     from CREATE STATISTICS commands of other users. The most common values may reveal column values the     eavesdropper could not otherwise read or results of functions they cannot execute.

    CVE-2024-7348:
    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack     involves replacing another relation type with a view or foreign table. The attack requires waiting for     pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction.
    Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.70. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1959 advisory.

    While modifying certain SQL array values, missing overflow checks let authenticated database users write     arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also     let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some     attacks of this description, but it missed others. (CVE-2023-5869)

    Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack     involves replacing another relation type with a view or foreign table. The attack requires waiting for     pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction.
    Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. (CVE-2024-7348)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
207301	Rocky Linux 8 : postgresql:16 (RLSA-2024:5927)	Nessus	Rocky Linux Local Security Checks	2024/9/16	2024/11/22	high
208044	Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-007)	Nessus	Amazon Linux Local Security Checks	2024/10/2	2024/12/11	high
205594	PostgreSQL 12.x < 12.20 / 13.x < 13.16 / 14.x < 14.13 / 15.x < 15.8 / 16.x 16.4 SQL Injection<	Nessus	Databases	2024/8/15	2025/8/13	high
210530	RHEL 9 : postgresql:15 (RHSA-2024:6140)	Nessus	Red Hat Local Security Checks	2024/11/7	2024/11/7	high
276305	TencentOS Server 2: postgresql (TSSA-2024:0736)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
238508	TencentOS Server 3: postgresql:15 (TSSA-2024:0774)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high
215024	Amazon Linux AMI : postgresql92 (ALAS-2025-1959)	Nessus	Amazon Linux Local Security Checks	2025/2/5	2025/2/5	high

检测

插件搜索

high

high

high

high

high

high

high