The version of PostgreSQL installed on the remote host is 9.2.x prior to 9.2.21, 9.3.x prior to 9.3.17, 9.4.x prior to 9.4.12, 9.5.x prior to 9.5.7, or 9.6.x prior to 9.6.3. It is, therefore, affected by multiple vulnerabilities :

  - A information disclosure vulnerability exists in     unspecified selectivity estimation functions due to     improper checking of user privileges before providing     information from pg_statistics. An authenticated, remote     attacker can exploit this to disclose potentially     sensitive information from restricted tables.
    (CVE-2017-7484)

  - A flaw exists because the PGREQUIRESSL environment     variable setting is not properly honored, which results     in a failure to require appropriate SSL/TLS connections.
    A man-in-the-middle attacker can exploit this to cause     an insecure, non-SSL/TLS connection between a client and     and a server. Note that version 9.2.x is not affected by     this vulnerability. (CVE-2017-7485)

  - A information disclosure vulnerability exists in the     pg_user_mappings view that allows access to user     mappings which may contain passwords that have persisted     from the CREATE USER MAPPING command. An authenticated,     remote attacker who has USAGE privilege on the     associated foreign server can exploit this to disclose     foreign server passwords. (CVE-2017-7486)

Detections

Analytics

PostgreSQL 9.2.x < 9.2.21 / 9.3.x < 9.3.17 / 9.4.x < 9.4.12 / 9.5.x < 9.5.7 / 9.6.x < 9.6.3 Multiple Vulnerabilities

high Nessus Plugin ID 100260

Version 1.19

Version 1.18

Version 1.19 Oct 23, 2024, 3:47 PM Plugin metadata (update thorough_tests attribute) Plugin Feed: 202410231547
Version 1.18 Apr 4, 2023, 12:12 PM Plugin metadata (remove thorough_tests attribute) Plugin Feed: 202304041212