An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account).

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: server processes unencrypted bytes from man-in-the-middle (CVE-2021-23214)

  - An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly     sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP     signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user     with sufficient privileges at the OS level (the postgres account or the root account). (CVE-2020-21469)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Detections

Analytics

CVE-2020-21469

medium

Tenable Plugins

high