Medium: postgresql96

Issue Overview: PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker...

Amazon Linux AMI : postgresql96 (ALAS-2020-1443)

The version of postgresql96 installed on the remote host is prior to 9.6.19-1.83. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1443 advisory. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common...

Amazon Linux AMI : postgresql94 (ALAS-2020-1441)

The version of postgresql94 installed on the remote host is prior to 9.4.26-1.77. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1441 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER...

Amazon Linux AMI : postgresql95 (ALAS-2020-1442)

The version of postgresql95 installed on the remote host is prior to 9.5.23-1.81. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1442 advisory. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common...

Authorization Bypass

postgresql is vulnerable to authroization bypass. The selectivity estimators allows an attacker to bypass row security policies and view common values of certain columns...

SQL Injection

PostgreSQL is vulnerable to SQL injection. TYPE in pgtemp executes arbitrary SQL during SECURITY DEFINER execution...

postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption...

Moderate: Red Hat Security Advisory: rh-postgresql96-postgresql security update

An update for rh-postgresql96-postgresql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

postgresql: Selectivity estimators bypass row security policies

PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit thi...

postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution

A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function...

postgresql: Uncontrolled search path element in CREATE EXTENSION

A flaw was found in PostgreSQL, where some PostgreSQL extensions did not use the searchpath safely in their installation script. This flaw allows an attacker with sufficient privileges to trick an administrator into executing a specially crafted script during the extension's installation or updat...

Security Bulletin: A security vulnerability in postgresql affects the IBM Cloud Pak for Multicloud Management Infrastructure Management Appliance

Summary A security vulnerability in postgresql affects the IBM Cloud Pak for Multicloud Management Infrastructure Management Appliance. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|---...

Photon OS 1.0: Postgresql PHSA-2020-1.0-0321

An update of the postgresql package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0321. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products

Summary Fixes for security vulnerabilities identified in IBM Security Access Manager and IBM Security Verify Access are available. Vulnerability Details CVEID: CVE-2020-11868 DESCRIPTION: NTP is vulnerable to a denial of service, caused by a flaw in ntpd. By sending a server mode packet with a...

SQL Express Maximum Database Size Limitation for Veeam Backup & Replication

Veeam Backup & Replication 12 Feature Starting with Veeam Backup & Replication 12, all new deployments will use PostgreSQL as the default database engine to host the configuration database. PostgreSQL does not have the limitations discussed in this article. Existing deployments upgraded from Veea...

HP Device Manager 4.x < 4.7 SP 13 / 5.x < 5.0.4 Multiple Vulnerabilities

According to its self-reported version number, the version of HP Device Manager installed on the remote Windows host is 4.x prior to 4.7 SP 13 or 5.x prior to 5.0.4. It is, therefore, affected by multiple vulnerabilities: - A weak cipher implementation that is susceptible to dictionary attacks...

PostgreSQL < 9.5.23, 9.6.x < 9.6.19, 10.x < 10.14, 11.x < 11.9, 12.x < 12.4 Search Path Vulnerability - Linux

PostgreSQL is prone to an uncontrolled search path element vulnerability in CREATE EXTENSION. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

PostgreSQL 10.x < 10.14, 11.x < 11.9, 12.x < 12.4 Search Path Vulnerability - Windows

PostgreSQL is prone to an uncontrolled search path element vulnerability in logical replication. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

PostgreSQL < 9.5.23, 9.6.x < 9.6.19, 10.x < 10.14, 11.x < 11.9, 12.x < 12.4 Search Path Vulnerability - Windows

PostgreSQL is prone to an uncontrolled search path element vulnerability in CREATE EXTENSION. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

PostgreSQL 10.x < 10.14, 11.x < 11.9, 12.x < 12.4 Search Path Vulnerability - Linux

PostgreSQL is prone to an uncontrolled search path element vulnerability in logical replication. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...