The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4535 advisory.

  - In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes. (CVE-2022-41862)

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS 8 : postgresql:12 (CESA-2023:4535)

high Nessus Plugin ID 179463

Version 1.1

Version 1.0

Version 1.1 Feb 8, 2024, 7:35 PM Detection (updated detection logic) Plugin Feed: 202402081935
Version 1.0 Aug 8, 2023, 8:34 PM New Plugin Feed: 202308082034