Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory.

New upstream release 11.5

Per release notes:
https://www.postgresql.org/docs/11/release-11-5.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release 10.10

Per release notes:
https://www.postgresql.org/docs/11/release-10-10.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.4.x prior to 9.4.24, 9.5.x prior to 9.5.19, 9.6.x prior to 9.6.15, 10.x prior to 10.10, or 11.x prior to 11.5. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified vulnerability that allows an attacker to execute arbitrary     SQL as the function's owner. (CVE-2019-10208)

  - An insecure password handling vulnerability exists in the     EnterpriseDB Windows intstaller due to use of a temporary file.
    An attack can exploit this to read the PostgreSQL superuser     password from the file. (CVE-2019-10210)

  - An arbitrary code execution vulnerability exists in libeay32.dll     due to use of a hard-coded configuration directory. An attacker     can exploit this to load and execute arbitrary code as the user     running a PostgreSQL server or client. (CVE-2019-10211)

ID	Name	Product	Family	Severity
127939	Fedora 30 : libpq / postgresql (2019-986fce48b4)	Nessus	Fedora Local Security Checks	critical
127934	Fedora 29 : postgresql (2019-5fbbf73269)	Nessus	Fedora Local Security Checks	critical
127905	PostgreSQL 9.4.x < 9.4.24 / 9.5.x < 9.5.19 / 9.6.x < 9.6.15 / 10.x < 10.10 / 11.x < 11.5 Multiple Vulnerabilities	Nessus	Databases	critical

Detections

Analytics

CVE-2019-10211

critical

Tenable Plugins

critical

critical

critical