PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2425 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.7).
    (BZ#1449701)

    Security Fix(es):

    * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN     commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL     to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423)

    * A flaw was found in the way PostgreSQL client programs handled database and role names containing     newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the     CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes     maintenance with a vulnerable client program. (CVE-2016-5424)

    * It was found that some selectivity estimation functions did not check user privileges before providing     information from pg_statistic, possibly leaking information. A non-administrative database user could use     this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

    * It was discovered that the PostgreSQL client library (libpq) did not enforce the use of TLS/SSL for a     connection to a PostgreSQL server when the PGREQUIRESSL environment variable was set. An man-in-the-middle     attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a     server. (CVE-2017-7485)

    * It was found that the pg_user_mappings view could disclose information about user mappings to a foreign     database to non-administrative database users. A database user with USAGE privilege for this mapping     could, when querying the view, obtain user mapping data, such as the username and password used to connect     to the foreign database. (CVE-2017-7486)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges     Robert Haas as the original reporter of CVE-2017-7484; Daniel Gustafsson as the original reporter of     CVE-2017-7485; and Andrew Wheelwright as the original reporter of CVE-2017-7486.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: Improper randomization of pgcrypto functions (requiring random seed) (CVE-2013-1900)

  - postgresql: Empty password accepted in some authentication methods (CVE-2017-7546)

  - The make check command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke     initdb to specify the authentication requirements for a database cluster to be used for the tests, which     allows local users to gain privileges by leveraging access to this cluster. (CVE-2014-0067)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: Start scripts permit database administrator to modify root-owned files (CVE-2017-15097)

  - postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

  - The make check command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke     initdb to specify the authentication requirements for a database cluster to be used for the tests, which     allows local users to gain privileges by leveraging access to this cluster. (CVE-2014-0067)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote host is affected by the vulnerability described in GLSA-201710-06 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could escalate privileges, cause a Denial of Service       condition, obtain passwords, cause a loss in information, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

According to the versions of the posrgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that some selectivity estimation functions     did not check user privileges before providing     information from pg_statistic, possibly leaking     information. A non-administrative database user could     use this flaw to steal some information from tables     they are otherwise not allowed to access.
    (CVE-2017-7484)

  - It was found that the pg_user_mappings view could     disclose information about user mappings to a foreign     database to non-administrative database users. A     database user with USAGE privilege for this mapping     could, when querying the view, obtain user mapping     data, such as the username and password used to connect     to the foreign database. (CVE-2017-7486)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for postgresql is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a later upstream version:
postgresql (9.2.21). (BZ#1449706)

Security Fix(es) :

* It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

* It was found that the pg_user_mappings view could disclose information about user mappings to a foreign database to non-administrative database users. A database user with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database. (CVE-2017-7486)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Robert Haas as the original reporter of CVE-2017-7484; and Andrew Wheelwright as the original reporter of CVE-2017-7486.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
postgresql (9.2.21).

Security Fix(es) :

  - It was found that some selectivity estimation functions     did not check user privileges before providing     information from pg_statistic, possibly leaking     information. A non-administrative database user could     use this flaw to steal some information from tables they     are otherwise not allowed to access. (CVE-2017-7484)

  - It was found that the pg_user_mappings view could     disclose information about user mappings to a foreign     database to non-administrative database users. A     database user with USAGE privilege for this mapping     could, when querying the view, obtain user mapping data,     such as the username and password used to connect to the     foreign database. (CVE-2017-7486)

Several vulnerabilities have been found in the PostgreSQL database system :

CVE-2017-7486

Andrew Wheelwright discovered that user mappings were insufficiently restricted.

CVE-2017-7546

In some authentication methods empty passwords were accepted.

CVE-2017-7547

User mappings could leak data to unprivileged users.

For Debian 7 'Wheezy', these problems have been fixed in version 9.1.24lts2-0+deb7u1.

We recommend that you upgrade your postgresql-9.1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1983 advisory.

    [9.2.21-1]
    - update to 9.2.21 per release notes       http://www.postgresql.org/docs/9.2/static/release-9-2-21.html       http://www.postgresql.org/docs/9.2/static/release-9-2-20.html       http://www.postgresql.org/docs/9.2/static/release-9-2-19.html

    [9.2.18-2]
    - package libpgport.a (rhbz#1305979)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for rh-postgresql95-postgresql is now available for Red Hat Satellite 5.8 and Red Hat Satellite 5.8 ELS.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

This update applies only to Satellite 5.8 instances using either embedded or managed PostgreSQL databases.

There are manual steps required in order to finish the migration from postgresql92-postgresql to rh-postgresql95-postgresql. If these steps are not undertaken, the affected Satellite will continue to use PostgreSQL 9.2.

postgresql92-postgresql will be upgraded automatically to rh-postgresql95-postgresql as part of an upgrade to Satellite 5.8.

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es) :

* It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. A non-administrative database user could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

* It was discovered that the PostgreSQL client library (libpq) did not enforce the use of TLS/SSL for a connection to a PostgreSQL server when the PGREQUIRESSL environment variable was set. An man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.
(CVE-2017-7485)

* It was found that the pg_user_mappings view could disclose information about user mappings to a foreign database to non-administrative database users. A database user with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database. (CVE-2017-7486)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Robert Haas as the original reporter of CVE-2017-7484; Daniel Gustafsson as the original reporter of CVE-2017-7485; and Andrew Wheelwright as the original reporter of CVE-2017-7486.

Fixes CVE-2017-7484 CVE-2017-7485 CVE-2017-7486.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql93 fixes the following issues :

  - bsc#1029547: Fix tests with timezone 2017a

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624)

  - CVE-2017-7485: Recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql94 to 9.4.12 fixes the following issues :

Upstream changelogs :

- https://www.postgresql.org/docs/9.4/static/release-9-4-12.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-11.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-10.html

Security issues fixed :

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624)

    Please note that manual action is needed to fix this in     existing databases See the upstream release notes for     details.

  - CVE-2017-7485: recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603)

Changes in version 9.4.12 :

  - Build corruption with CREATE INDEX CONCURRENTLY

  - Fixes for visibility and write-ahead-log stability

Changes in version 9.4.10 :

  - Fix WAL-logging of truncation of relation free space     maps and visibility maps

  - Fix incorrect creation of GIN index WAL records on     big-endian machines

  - Fix SELECT FOR UPDATE/SHARE to correctly lock tuples     that have been updated by a subsequently-aborted     transaction

  - Fix EvalPlanQual rechecks involving CTE scans

  - Fix improper repetition of previous results from hashed     aggregation in a subquery

The libraries libpq and libecpg are now supplied by postgresql 9.6.

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql94 to 9.4.12 fixes the following issues:
Upstream changelogs :

- https://www.postgresql.org/docs/9.4/static/release-9-4-12.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-11.html

- https://www.postgresql.org/docs/9.4/static/release-9-4-10.html Security issues fixed :

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624) Please note that     manual action is needed to fix this in existing     databases See the upstream release notes for details.

  - CVE-2017-7485: recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603) Changes     in version 9.4.12 :

  - Build corruption with CREATE INDEX CONCURRENTLY

  - Fixes for visibility and write-ahead-log stability     Changes in version 9.4.10 :

  - Fix WAL-logging of truncation of relation free space     maps and visibility maps

  - Fix incorrect creation of GIN index WAL records on     big-endian machines

  - Fix SELECT FOR UPDATE/SHARE to correctly lock tuples     that have been updated by a subsequently-aborted     transaction

  - Fix EvalPlanQual rechecks involving CTE scans

  - Fix improper repetition of previous results from hashed     aggregation in a subquery The libraries libpq and     libecpg are now supplied by postgresql 9.6.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql93 fixes the following issues :

The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes.

Security fixes :

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624) 

  - CVE-2017-7485: Recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603)

More details can be found in the PostgreSQL release announcements :

- https://www.postgresql.org/docs/9.3/static/release-9-3-17.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-16.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-15.html

This update was imported from the SUSE:SLE-12:Update update project.

Selectivity estimators bypass SELECT privilege checks

It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

libpq ignores PGREQUIRESSL environment variable

It was found that the PGREQUIRESSL was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. (CVE-2017-7485)

pg_user_mappings view discloses foreign server passwords

It was found that the pg_user_mappings view from postgresql could disclose information about user mappings to a foreign database to unprivileged users. An authenticated attacker with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database. (CVE-2017-7486)

Selectivity estimators bypass SELECT privilege checks

It was found that some selectivity estimation functions did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. (CVE-2017-7484)

pg_user_mappings view discloses foreign server passwords

It was found that the pg_user_mappings view from postgresql could disclose information about user mappings to a foreign database to unprivileged users. An authenticated attacker with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password used to connect to the foreign database. (CVE-2017-7486 )

This update for postgresql93 fixes the following issues: The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes. Bug fixes :

  - bsc#1029547: Fix tests with timezone 2017a

  - CVE-2017-7486: Restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1037624)

  - CVE-2017-7485: Recognize PGREQUIRESSL variable again.
    (bsc#1038293)

  - CVE-2017-7484: Prevent exposure of statistical     information via leaky operators. (bsc#1037603) More     details can be found in the PostgreSQL release     announcements :

- https://www.postgresql.org/docs/9.3/static/release-9-3-17.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-16.html

- https://www.postgresql.org/docs/9.3/static/release-9-3-15.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.2.x prior to 9.2.21, 9.3.x prior to 9.3.17, 9.4.x prior to 9.4.12, 9.5.x prior to 9.5.7 or 9.6.x prior to 9.6.3 and is affected by a the following vulnerabilities :

 - A flaw exists in some selectivity estimation functions that is triggered as user privileges are not properly checked before providing information from pg_statistics. This may allow an authenticated remote attacker to gain access to potentially sensitive information from restricted tables. (CVE-2017-7484)
 - A flaw exists that is triggered as the PGREQUIRESSL setting is not properly honored, resulting in SSL/TLS connections not being appropriately required. This may allow a man-in-the-middle attacker to force a potentially insecure, non-SSL/TLS connection. (CVE-2017-7485)
 - A flaw exists in the pg_user_mappings view that is triggered as it allows access to user mappings which may contain passwords which persist from the 'CREATE USER MAPPING' command. This may allow an authenticated remote attacker to gain access to foreign server passwords. (CVE-2017-7486)

The version of PostgreSQL installed on the remote host is 9.2.x prior to 9.2.21, 9.3.x prior to 9.3.17, 9.4.x prior to 9.4.12, 9.5.x prior to 9.5.7, or 9.6.x prior to 9.6.3. It is, therefore, affected by multiple vulnerabilities :

  - A information disclosure vulnerability exists in     unspecified selectivity estimation functions due to     improper checking of user privileges before providing     information from pg_statistics. An authenticated, remote     attacker can exploit this to disclose potentially     sensitive information from restricted tables.
    (CVE-2017-7484)

  - A flaw exists because the PGREQUIRESSL environment     variable setting is not properly honored, which results     in a failure to require appropriate SSL/TLS connections.
    A man-in-the-middle attacker can exploit this to cause     an insecure, non-SSL/TLS connection between a client and     and a server. Note that version 9.2.x is not affected by     this vulnerability. (CVE-2017-7485)

  - A information disclosure vulnerability exists in the     pg_user_mappings view that allows access to user     mappings which may contain passwords that have persisted     from the CREATE USER MAPPING command. An authenticated,     remote attacker who has USAGE privilege on the     associated foreign server can exploit this to disclose     foreign server passwords. (CVE-2017-7486)

Several vulnerabilities have been found in the PostgreSQL database system :

  - CVE-2017-7484     Robert Haas discovered that some selectivity estimators     did not validate user privileges which could result in     information disclosure.

  - CVE-2017-7485     Daniel Gustafsson discovered that the PGREQUIRESSL     environment variable did no longer enforce a TLS     connection.

  - CVE-2017-7486     Andrew Wheelwright discovered that user mappings were     insufficiently restricted.

ID	Name	Product	Family	Severity
210311	RHEL 6 : rh-postgresql95-postgresql (RHSA-2017:2425)	Nessus	Red Hat Local Security Checks	high
198842	RHEL 5 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198784	RHEL 6 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195391	RHEL 6 : postgresql (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
103724	GLSA-201710-06 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
103074	EulerOS 2.0 SP2 : posrgresql (EulerOS-SA-2017-1216)	Nessus	Huawei Local Security Checks	high
103073	EulerOS 2.0 SP1 : posrgresql (EulerOS-SA-2017-1215)	Nessus	Huawei Local Security Checks	high
102747	CentOS 7 : postgresql (CESA-2017:1983)	Nessus	CentOS Local Security Checks	high
102653	Scientific Linux Security Update : postgresql on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	high
102368	Debian DLA-1051-1 : postgresql-9.1 security update	Nessus	Debian Local Security Checks	critical
102292	Oracle Linux 7 : postgresql (ELSA-2017-1983)	Nessus	Oracle Linux Local Security Checks	high
102142	RHEL 5 : rh-postgresql95-postgresql (RHSA-2017:1838)	Nessus	Red Hat Local Security Checks	medium
102108	RHEL 7 : postgresql (RHSA-2017:1983)	Nessus	Red Hat Local Security Checks	high
101572	Fedora 26 : mingw-postgresql (2017-0d5817efc0)	Nessus	Fedora Local Security Checks	high
101260	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2017:1783-1)	Nessus	SuSE Local Security Checks	high
101220	openSUSE Security Update : postgresql94 (openSUSE-2017-770)	Nessus	SuSE Local Security Checks	high
101060	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2017:1690-1)	Nessus	SuSE Local Security Checks	high
100659	openSUSE Security Update : postgresql93 (openSUSE-2017-657)	Nessus	SuSE Local Security Checks	high
100640	Amazon Linux AMI : postgresql93 / postgresql94,postgresql95 (ALAS-2017-839)	Nessus	Amazon Linux Local Security Checks	high
100639	Amazon Linux AMI : postgresql92 (ALAS-2017-838)	Nessus	Amazon Linux Local Security Checks	high
100538	SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2017:1441-1)	Nessus	SuSE Local Security Checks	high
700120	PostgreSQL 9.2.x < 9.2.21 / 9.3.x < 9.3.17 / 9.4.x < 9.4.12 / 9.5.x < 9.5.7 / 9.6.x < 9.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
100260	PostgreSQL 9.2.x < 9.2.21 / 9.3.x < 9.3.17 / 9.4.x < 9.4.12 / 9.5.x < 9.5.7 / 9.6.x < 9.6.3 Multiple Vulnerabilities	Nessus	Databases	high
100165	Debian DSA-3851-1 : postgresql-9.4 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-7486

high

Tenable Plugins

high

critical

high

high

critical

high

high

high

high

critical

high

medium

high

high

high

high

high

high

high

high

high

medium

high

high