In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can allow an authenticated attacker to read or modify the one file, which may contain encrypted or unencrypted database passwords. The attack is infeasible if a directory mode blocks the attacker searching the current working directory or if the prevailing umask blocks the attacker opening the file.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2566 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql96-postgresql     (9.6.10). (BZ#1614340)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, CVE-2017-15099, and CVE-2018-1115. Upstream acknowledges Andrew Krasichkov     as the original reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom     Lane as the original reporter of CVE-2018-1053; Dean Rasheed as the original reporter of CVE-2017-15099;
    and Stephen Frost as the original reporter of CVE-2018-1115.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3816 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925 and     CVE-2018-1053. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915; and Tom     Lane as the original reporter of CVE-2018-1053.

    Additional Changes:

    This update fixes various bugs and adds enhancements. Documentation for these changes is available from     the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2511 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql     (9.5.14). (BZ#1612671)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, and CVE-2017-15099. Upstream acknowledges Andrew Krasichkov as the original     reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom Lane as the     original reporter of CVE-2018-1053; and Dean Rasheed as the original reporter of CVE-2017-15099.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the postgresql package has been released.

This update for postgresql94 fixes the following issues :

PostgreSQL was updated to version 9.4.15, the full release notes are here :

&#9;https://www.postgresql.org/docs/9.4/static/release-9-4-15.html

  - CVE-2018-1053: Ensure that all temporary files made by     pg_upgrade are non-world-readable. (bsc#1077983)

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.15, the full release notes are here:
&#9;https://www.postgresql.org/docs/9.4/static/release-9-4-15.html

  - CVE-2018-1053: Ensure that all temporary files made by     pg_upgrade are non-world-readable. (bsc#1077983)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql95 fixes the following issues :

Upate to PostgreSQL 9.5.11 :

Security issues fixed :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-11.html 

  - CVE-2018-1053, boo#1077983: Ensure that all temporary     files made by pg_upgrade are non-world-readable. 

  - boo#1079757: Rename pg_rewind's copy_file_range function     to avoid conflict with new Linux system call of that     name.

In version 9.5.10 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-10.html

  - CVE-2017-15098, boo#1067844: Memory disclosure in JSON     functions.

  - CVE-2017-15099, boo#1067841: INSERT ... ON CONFLICT DO     UPDATE fails to enforce SELECT privileges.

In version 9.5.9 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-9.html

  - Show foreign tables in     information_schema.table_privileges view.

  - Clean up handling of a fatal exit (e.g., due to receipt     of SIGTERM) that occurs while trying to execute a     ROLLBACK of a failed transaction.

  - Remove assertion that could trigger during a fatal exit.

  - Correctly identify columns that are of a range type or     domain type over a composite type or domain type being     searched for.

  - Fix crash in pg_restore when using parallel mode and     using a list file to select a subset of items to     restore.

  - Change ecpg's parser to allow RETURNING clauses without     attached C variables.

In version 9.5.8

  - https://www.postgresql.org/docs/9.5/static/release-9-5-8.html

  - CVE-2017-7547, boo#1051685: Further restrict visibility     of pg_user_mappings.umoptions, to protect passwords     stored as user mapping options.

  - CVE-2017-7546, boo#1051684: Disallow empty passwords in     all password-based authentication methods.

  - CVE-2017-7548, boo#1053259: lo_put() function ignores     ACLs.

This update for postgresql96 to version 9.6.7 fixes the following issues :

  - CVE-2018-1053: Ensure that all temporary files made by     pg_upgrade are non-world-readable. (bsc#1077983)

A full changelog is available here :

&#9;https://www.postgresql.org/docs/9.6/static/release-9-6-7.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql96 to version 9.6.7 fixes the following issues :

  - CVE-2018-1053: Ensure that all temporary files made by     pg_upgrade are non-world-readable. (bsc#1077983) A full     changelog is available here:
    &#9;https://www.postgresql.org/docs/9.6/static/release-9
    -6-7.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.16, full release notes:
&#9;https://www.postgresql.org/docs/9.4/static/release-9-4-16.html Security issues fixed :

  - CVE-2018-1053: Ensure that all temporary files made by     pg_upgrade are non-world-readable. (bsc#1077983)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.21, 9.4.x prior to 9.4.16, 9.5.x prior to 9.5.11, 9.6.x prior to 9.6.7, or 10.x prior to 10.2. It is, therefore, affected by multiple vulnerabilities.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3564-1 advisory.

    It was discovered that PostgreSQL incorrectly handled certain temp files. An attacker could possibly use     this to access sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The PostgreSQL project reports :

- CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)

- CVE-2018-1053: Ensure that all temporary files made with 'pg_upgrade' are non-world-readable

A vulnerabilities has been found in the PostgreSQL database system :

CVE-2018-1053

Tom Lane discovered that pg_upgrade, a tool used to upgrade PostgreSQL database clusters, creates temporary files containing password hashes that are world-readable.

For Debian 7 'Wheezy', this problem has been fixed in version 9.1.24lts2-0+deb7u2.

We recommend that you upgrade your postgresql-9.1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
194117	RHEL 6 / 7 : rh-postgresql96-postgresql (RHSA-2018:2566)	Nessus	Red Hat Local Security Checks	critical
194110	RHEL 7 : CloudForms 4.6.6 (RHSA-2018:3816)	Nessus	Red Hat Local Security Checks	high
194013	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2018:2511)	Nessus	Red Hat Local Security Checks	high
121919	Photon OS 2.0: Postgresql PHSA-2018-2.0-0016	Nessus	PhotonOS Local Security Checks	high
121809	Photon OS 1.0: Postgresql PHSA-2018-1.0-0108	Nessus	PhotonOS Local Security Checks	high
108391	openSUSE Security Update : postgresql94 (openSUSE-2018-257)	Nessus	SuSE Local Security Checks	high
108368	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2018:0675-1)	Nessus	SuSE Local Security Checks	high
106965	openSUSE Security Update : postgresql95 (openSUSE-2018-204)	Nessus	SuSE Local Security Checks	critical
106964	openSUSE Security Update : postgresql96 (openSUSE-2018-203)	Nessus	SuSE Local Security Checks	high
106942	SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2018:0507-1)	Nessus	SuSE Local Security Checks	high
106941	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2018:0506-1)	Nessus	SuSE Local Security Checks	high
106842	PostgreSQL 9.3.x < 9.3.21 / 9.4.x < 9.4.16 / 9.5.x < 9.5.11 / 9.6.x < 9.6.7 / 10.x < 10.2 Multiple Vulnerabilities	Nessus	Databases	medium
106749	Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerability (USN-3564-1)	Nessus	Ubuntu Local Security Checks	high
106701	FreeBSD : PostgreSQL vulnerabilities (c602c791-0cf4-11e8-a2ec-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
106659	Debian DLA-1271-1 : postgresql-9.1 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-1053

high

Tenable Plugins

critical

high

high

high

high

high

high

critical

high

high

high

medium

high

high

high