A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: Improper randomization of pgcrypto functions (requiring random seed) (CVE-2013-1900)

  - postgresql: Empty password accepted in some authentication methods (CVE-2017-7546)

  - The make check command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke     initdb to specify the authentication requirements for a database cluster to be used for the tests, which     allows local users to gain privileges by leveraging access to this cluster. (CVE-2014-0067)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

  - It was found that some PostgreSQL extensions did not use search_path safely in their installation script.
    An attacker with sufficient privileges could use this flaw to trick an administrator into executing a     specially crafted script, during the installation or update of such extension. This affects PostgreSQL     versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23. (CVE-2020-14350)

  - A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on     one column to craft a special query that returns all columns of the table. The highest threat from this     vulnerability is to confidentiality. (CVE-2021-20229)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: Start scripts permit database administrator to modify root-owned files (CVE-2017-15097)

  - postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

  - The make check command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke     initdb to specify the authentication requirements for a database cluster to be used for the tests, which     allows local users to gain privileges by leveraging access to this cluster. (CVE-2014-0067)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2566 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql96-postgresql     (9.6.10). (BZ#1614340)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    * postgresql: Too-permissive access control list on function pg_logfile_rotate() (CVE-2018-1115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, CVE-2017-15099, and CVE-2018-1115. Upstream acknowledges Andrew Krasichkov     as the original reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom     Lane as the original reporter of CVE-2018-1053; Dean Rasheed as the original reporter of CVE-2017-15099;
    and Stephen Frost as the original reporter of CVE-2018-1115.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3816 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925 and     CVE-2018-1053. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915; and Tom     Lane as the original reporter of CVE-2018-1053.

    Additional Changes:

    This update fixes various bugs and adds enhancements. Documentation for these changes is available from     the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2511 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql     (9.5.14). (BZ#1612671)

    Security Fix(es):

    * postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

    * postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements     (CVE-2018-10925)

    * postgresql: Memory disclosure in JSON functions (CVE-2017-15098)

    * postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask (CVE-2018-1053)

    * postgresql: Uncontrolled search path element in pg_dump and other client applications (CVE-2018-1058)

    * postgresql: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges (CVE-2017-15099)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915, CVE-2018-10925,     CVE-2017-15098, CVE-2018-1053, and CVE-2017-15099. Upstream acknowledges Andrew Krasichkov as the original     reporter of CVE-2018-10915; David Rowley as the original reporter of CVE-2017-15098; Tom Lane as the     original reporter of CVE-2018-1053; and Dean Rasheed as the original reporter of CVE-2017-15099.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the postgresql package has been released.

This update for postgresql94 fixes the following issues :

Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925).

Bug fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.4/static/release-9-4-17.html

  - https://www.postgresql.org/docs/9.4/static/release-9-4-16.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql94 fixes the following issues: Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925). Bug     fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.4/static/release-9-4-17.html

  - https://www.postgresql.org/docs/9.4/static/release-9-4-16.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. (CVE-2018-1058)

This update for postgresql96 fixes the following issues: Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925). Bug     fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.6/static/release-9-6-8.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql96 fixes the following issues :

Security issues fixed :

  - CVE-2018-1058: Fixed uncontrolled search path element in     pg_dump and other client applications (bsc#1081925).

Bug fixes :

  - See release notes for details :

  - https://www.postgresql.org/docs/9.6/static/release-9-6-8.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql95 fixes the following issues :

Security issue fixed in PostgreSQL 9.5.12 :

  - CVE-2018-1058: Uncontrolled search path element in     pg_dump and other client applications (boo#1081925).

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.22, 9.4.x prior to 9.4.17, 9.5.x prior to 9.5.12, 9.6.x prior to 9.6.8, or 10.x prior to 10.3. It is, therefore, affected by a privilege escalation vulnerability.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3589-1 advisory.

    It was discovered that PostgreSQL incorrectly handled certain settings. An attacker could possibly use     this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The PostgreSQL project reports :

- CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications

ID	Name	Product	Family	Severity
198842	RHEL 5 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198788	RHEL 7 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198784	RHEL 6 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
194117	RHEL 6 / 7 : rh-postgresql96-postgresql (RHSA-2018:2566)	Nessus	Red Hat Local Security Checks	critical
194110	RHEL 7 : CloudForms 4.6.6 (RHSA-2018:3816)	Nessus	Red Hat Local Security Checks	high
194013	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2018:2511)	Nessus	Red Hat Local Security Checks	high
121931	Photon OS 2.0: Postgresql PHSA-2018-2.0-0031	Nessus	PhotonOS Local Security Checks	high
121817	Photon OS 1.0: Postgresql PHSA-2018-1.0-0122	Nessus	PhotonOS Local Security Checks	high
108932	openSUSE Security Update : postgresql94 (openSUSE-2018-340)	Nessus	SuSE Local Security Checks	high
108873	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2018:0876-1)	Nessus	SuSE Local Security Checks	high
108851	Amazon Linux AMI : postgresql93 / postgresql94,postgresql95,postgresql96 (ALAS-2018-990)	Nessus	Amazon Linux Local Security Checks	high
108531	SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2018:0756-1)	Nessus	SuSE Local Security Checks	high
108530	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2018:0755-1)	Nessus	SuSE Local Security Checks	high
108527	openSUSE Security Update : postgresql96 (openSUSE-2018-287)	Nessus	SuSE Local Security Checks	high
108443	openSUSE Security Update : postgresql95 (openSUSE-2018-279)	Nessus	SuSE Local Security Checks	high
107226	PostgreSQL 9.3.x < 9.3.22 / 9.4.x < 9.4.17 / 9.5.x < 9.5.12 / 9.6.x < 9.6.8 / 10.x < 10.3 Privilege Escalation Vulnerability	Nessus	Databases	high
107192	Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerability (USN-3589-1)	Nessus	Ubuntu Local Security Checks	high
107112	FreeBSD : PostgreSQL vulnerabilities (e3eeda2e-1d67-11e8-a2ec-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-1058

high

Tenable Plugins

critical

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high