The version of PostgreSQL installed on the remote host is 10 prior to 10.21, 11 prior to 11.16, 12 prior to 12.11, 13 prior to 13.7, or 14 prior to 14.3. As such, it is potentially affected by a privilege escalation vulnerability:

  - Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck made incomplete efforts to     operate safely when a privileged user is maintaining another user's objects. Those commands activated relevant     protections too late or not at all. An attacker having permission to create non-temp objects in at least one schema     could execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4893 advisory.

  - postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5162 advisory.

  - postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4913 advisory.

  - postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4915 advisory.

  - postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1804-1 advisory.

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote host is prior to 12.11-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL12-2023-002 advisory.

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of postgresql installed on the remote host is prior to 13.7-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-002 advisory.

  - A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use     of SSL certificate verification and encryption. (CVE-2021-23222)

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5676-1 advisory.

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-190 advisory.

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
161801	PostgreSQL 10.x < 10.21 / 11.x < 11.16 / 12.x < 12.11 / 13.x < 13.7 / 14.x < 14.3 Privilege Escalation	Nessus	Databases	6/3/2022	3/5/2024	high
161835	RHEL 8 : postgresql:12 (RHSA-2022:4893)	Nessus	Red Hat Local Security Checks	6/4/2022	4/28/2024	high
162489	Oracle Linux 7 : postgresql (ELSA-2022-5162)	Nessus	Oracle Linux Local Security Checks	6/22/2022	12/9/2022	high
161898	RHEL 7 : rh-postgresql10-postgresql (RHSA-2022:4913)	Nessus	Red Hat Local Security Checks	6/6/2022	4/28/2024	high
161905	RHEL 7 : rh-postgresql12-postgresql (RHSA-2022:4915)	Nessus	Red Hat Local Security Checks	6/6/2022	4/28/2024	high
161459	SUSE SLES12 Security Update : postgresql10 (SUSE-SU-2022:1804-1)	Nessus	SuSE Local Security Checks	5/24/2022	7/14/2023	high
182052	Amazon Linux 2 : postgresql (ALASPOSTGRESQL12-2023-002)	Nessus	Amazon Linux Local Security Checks	9/27/2023	3/5/2024	high
182064	Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-002)	Nessus	Amazon Linux Local Security Checks	9/27/2023	3/5/2024	high
166114	Ubuntu 16.04 ESM : PostgreSQL vulnerability (USN-5676-1)	Nessus	Ubuntu Local Security Checks	10/14/2022	7/10/2023	high
166662	EulerOS 2.0 SP3 : postgresql (EulerOS-SA-2022-2631)	Nessus	Huawei Local Security Checks	10/28/2022	11/28/2022	high
167014	Amazon Linux 2022 : (ALAS2022-2022-190)	Nessus	Amazon Linux Local Security Checks	11/5/2022	11/28/2022	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high