The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2462 advisory.

    This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap     superuser. Database owners have that right by default, and explicit grants may extend it to other users.
    (CVE-2023-2454)

    While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario     involving function inlining. This leads to potentially incorrect policies being applied in cases where     role-specific policies are used and a given query is planned under one role and then executed under other     roles. This scenario can happen under security definer functions or when a common user and query is     planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a     user to complete otherwise-forbidden reads and modifications. This affects only databases that have used     CREATE POLICY to define a row security policy. (CVE-2023-2455)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : postgresql (ALAS-2024-2462)

high Nessus Plugin ID 190696

Version 1.2

Version 1.1

Version 1.2 Mar 1, 2025, 8:12 AM CVE (set "CVE" coverage to "CVE-2023-2454,CVE-2023-2455") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202503010812
Version 1.1 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955