The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-10830 advisory.

    pgaudit     pg_repack     postgres-decoderbufs     postgresql     [15.10-1]
    - Update to 15.10
    - Fixes: CVE-2024-10976 CVE-2024-10978 CVE-2024-10979

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202412-12 (PostgreSQL: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4174-1 advisory.

    - CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a     non-top-level table reference (bsc#1233323).
    - CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiation     (bsc#1233325).
    - CVE-2024-10978: Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE     (bsc#1233326).
    - CVE-2024-10979: Prevent trusted PL/Perl code from changing environment variables (bsc#1233327).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4095-1 advisory.

    - CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a     non-top-level table reference (bsc#1233323).
    - CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiation     (bsc#1233325).
    - CVE-2024-10978: Fix unintended interactions between SET SESSION AUTHORIZATION and SET ROLE     (bsc#1233326).
    - CVE-2024-10979: Prevent trusted PL/Perl code from changing environment variables (bsc#1233327).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10830 advisory.

    * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978)

    * postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979)

    * postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the postgresql14 package has been released.

An update of the postgresql15 package has been released.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7358-1 advisory.

    Wolfgang Walther discovered that PostgreSQL incorrectly tracked tables with row security. A remote     attacker could possibly use this issue to perform forbidden reads and modifications. (CVE-2024-10976)

    Jacob Champion discovered that PostgreSQL clients used untrusted server error messages. An attacker that     is able to intercept network communications could possibly use this issue to inject error messages that     could be interpreted as valid query results. (CVE-2024-10977)

    Tom Lane discovered that PostgreSQL incorrectly handled certain privilege assignments. A remote attacker     could possibly use this issue to view or change different rows from those intended. (CVE-2024-10978)

    Coby Abrams discovered that PostgreSQL incorrectly handled environment variables. A remote attacker could     possibly use this issue to execute arbitrary code. (CVE-2024-10979)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
212138	Oracle Linux 8 : postgresql:15 (ELSA-2024-10830)	Nessus	Oracle Linux Local Security Checks	12/6/2024	2/21/2025	high
212180	GLSA-202412-12 : PostgreSQL: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	12/9/2024	2/12/2025	high
212517	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : postgresql15 (SUSE-SU-2024:4174-1)	Nessus	SuSE Local Security Checks	12/12/2024	2/21/2025	high
212582	SUSE SLES12 Security Update : postgresql15 (SUSE-SU-2024:4095-1)	Nessus	SuSE Local Security Checks	12/12/2024	2/21/2025	high
213208	RockyLinux 8 : postgresql:15 (RLSA-2024:10830)	Nessus	Rocky Linux Local Security Checks	12/19/2024	2/12/2025	high
213429	Photon OS 5.0: Postgresql14 PHSA-2024-5.0-0419	Nessus	PhotonOS Local Security Checks	12/30/2024	2/21/2025	high
213431	Photon OS 5.0: Postgresql15 PHSA-2024-5.0-0419	Nessus	PhotonOS Local Security Checks	12/30/2024	2/21/2025	high
233017	Ubuntu 16.04 LTS : PostgreSQL vulnerabilities (USN-7358-1)	Nessus	Ubuntu Local Security Checks	3/20/2025	3/20/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high