The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2372 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATEmore details (CVE-2021-32028)

  - An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A     user having UPDATE permission but not SELECT permission to a particular column could craft queries which,     under some circumstances, might disclose values from that column in error messages. An attacker could use     this flaw to obtain information stored in a column they are allowed to write but not read. (CVE-2021-3393)

  - Memory disclosure in partitioned-table UPDATE ... RETURNINGmore details (CVE-2021-32029)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2397 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1785-2 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted     table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-32028)

  - A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an     authenticated database user could read arbitrary bytes of server memory. The highest threat from this     vulnerability is to data confidentiality. (CVE-2021-32029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9428 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2361 advisory.

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in postgresql in versions before 13.3,     before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values,     missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2021-32027)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has postgresql packages installed that are affected by multiple vulnerabilities:

  - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before     9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a     suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute     arbitrary SQL as the owner of the function. (CVE-2019-10208)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses     the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-     the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat     from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-25694)

  - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before     9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one     schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695)

  - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before     9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users     write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-32027)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2391 advisory.

  - postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2395 advisory.

  - postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2392 advisory.

  - postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2393 advisory.

  - postgresql: Buffer overrun from integer overflow in array subscripting calculations (CVE-2021-32027)

  - postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE (CVE-2021-32028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
150723	Oracle Linux 8 : postgresql:12 (ELSA-2021-2372)	Nessus	Oracle Linux Local Security Checks	6/11/2021	8/19/2021	high
150779	Oracle Linux 7 : postgresql (ELSA-2021-2397)	Nessus	Oracle Linux Local Security Checks	6/15/2021	8/19/2021	high
151492	SUSE SLES15 Security Update : postgresql13 (SUSE-SU-2021:1785-2)	Nessus	SuSE Local Security Checks	7/12/2021	7/13/2023	high
152754	Oracle Linux 7 : rh-postgresql10-postgresql (ELSA-2021-9428)	Nessus	Oracle Linux Local Security Checks	8/23/2021	8/23/2021	high
153180	Oracle Linux 8 : postgresql:10 (ELSA-2021-2361)	Nessus	Oracle Linux Local Security Checks	9/9/2021	9/9/2021	high
153274	EulerOS 2.0 SP2 : postgresql (EulerOS-SA-2021-2426)	Nessus	Huawei Local Security Checks	9/14/2021	11/30/2023	high
160799	NewStart CGSL CORE 5.05 / MAIN 5.05 : postgresql Multiple Vulnerabilities (NS-SA-2022-0038)	Nessus	NewStart CGSL Local Security Checks	5/9/2022	5/9/2022	high
150757	RHEL 8 : postgresql:9.6 (RHSA-2021:2391)	Nessus	Red Hat Local Security Checks	6/14/2021	4/28/2024	high
150795	RHEL 7 : rh-postgresql10-postgresql (RHSA-2021:2395)	Nessus	Red Hat Local Security Checks	6/15/2021	4/28/2024	high
150824	RHEL 8 : postgresql:10 (RHSA-2021:2392)	Nessus	Red Hat Local Security Checks	6/16/2021	4/28/2024	high
150828	RHEL 8 : postgresql:9.6 (RHSA-2021:2393)	Nessus	Red Hat Local Security Checks	6/16/2021	4/28/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high