The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1908-1 advisory.

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-4855 advisory.

    - Resolves: CVE-2022-1552
    - Resolves: CVE-2022-1552

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 10 prior to 10.21, 11 prior to 11.16, 12 prior to 12.11, 13 prior to 13.7, or 14 prior to 14.3. As such, it is potentially affected by a privilege escalation vulnerability:

  - Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck made incomplete efforts to     operate safely when a privileged user is maintaining another user's objects. Those commands activated relevant     protections too late or not at all. An attacker having permission to create non-temp objects in at least one schema     could execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4893 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: postgresql (12.11).

    Security Fix(es):

    * postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox (CVE-2022-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4913 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql10-postgresql (10.21).

    Security Fix(es):

    * postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox (CVE-2022-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4915 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql12-postgresql (12.11).

    Security Fix(es):

    * postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox (CVE-2022-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5162 advisory.

    - Resolves: CVE-2022-1552

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - postgresql: Autovacuum, REINDEX, and others omit 'security restricted operation' sandbox (CVE-2022-1552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5676-1 advisory.

    Alexander Lakhin discovered that PostgreSQL incorrectly handled the security restricted operation sandbox     when a privileged user is maintaining another users objects. An attacker having permission to create     non-temp objects can use this issue to execute arbitrary commands as the superuser.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-190 advisory.

    A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
161786	SUSE SLED15 / SLES15 Security Update : postgresql14 (SUSE-SU-2022:1908-1)	Nessus	SuSE Local Security Checks	6/2/2022	7/14/2023	high
161792	Oracle Linux 8 : postgresql:13 (ELSA-2022-4855)	Nessus	Oracle Linux Local Security Checks	6/2/2022	10/22/2024	high
161801	PostgreSQL 10.x < 10.21 / 11.x < 11.16 / 12.x < 12.11 / 13.x < 13.7 / 14.x < 14.3 Privilege Escalation	Nessus	Databases	6/3/2022	2/5/2025	high
161835	RHEL 8 : postgresql:12 (RHSA-2022:4893)	Nessus	Red Hat Local Security Checks	6/4/2022	11/7/2024	high
161898	RHEL 7 : rh-postgresql10-postgresql (RHSA-2022:4913)	Nessus	Red Hat Local Security Checks	6/6/2022	11/8/2024	high
161905	RHEL 7 : rh-postgresql12-postgresql (RHSA-2022:4915)	Nessus	Red Hat Local Security Checks	6/6/2022	11/7/2024	high
162489	Oracle Linux 7 : postgresql (ELSA-2022-5162)	Nessus	Oracle Linux Local Security Checks	6/22/2022	11/1/2024	high
164186	EulerOS 2.0 SP5 : postgresql (EulerOS-SA-2022-2278)	Nessus	Huawei Local Security Checks	8/17/2022	12/7/2022	high
166114	Ubuntu 16.04 ESM : PostgreSQL vulnerability (USN-5676-1)	Nessus	Ubuntu Local Security Checks	10/14/2022	8/27/2024	high
166662	EulerOS 2.0 SP3 : postgresql (EulerOS-SA-2022-2631)	Nessus	Huawei Local Security Checks	10/28/2022	11/28/2022	high
167014	Amazon Linux 2022 : postgresql14, postgresql14-contrib, postgresql14-llvmjit (ALAS2022-2022-190)	Nessus	Amazon Linux Local Security Checks	11/5/2022	12/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high