ROS-2-1245

2.1245 Multiple vulnerabilities in PostgreSQL CVE-2021-32027, CVE-2021-32028, CVE-2021-32029 1. Vulnerability Description: CVE-2021-32027 The vulnerability allows a remote attacker to execute arbitrary code on the target system. CVE-2021-32028, CVE-2021-32029 Vulnerability allows a remote user to...

CVE-2021-3677

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include...

EulerOS 2.0 SP5 : postgresql (EulerOS-SA-2021-2344)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL...

Huawei EulerOS: Security Advisory for postgresql (EulerOS-SA-2021-2344)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2751-1 : postgresql-9.6 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2751 advisory. PostgreSQL 9.6.23 fixes this security issue: Disallow SSL renegotiation more completely Michael Paquier SSL renegotiation has been disabled for some time, but the server...

Debian: Security Advisory (DLA-2751-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2751-1] postgresql-9.6 security update

Debian LTS Advisory DLA-2751-1 [email protected] https://www.debian.org/lts/security/ Christoph Berg August 31, 2021 https://wiki.debian.org/LTS Package : postgresql-9.6 Version : 9.6.23-0+deb9u1 CVE ID : CVE-2021-3449 PostgreSQL 9.6.23 fixes this security issue: Disallow SSL...

DLA-2751-1 postgresql-9.6 - security update

Bulletin has no description...

Gopherus

This is a Python script for a tool called Gopherus, which is used to exploit Server-Side Request Forgery SSRF vulnerabilities in various services. The tool can generate payloads for different services, including MySQL, PostgreSQL, FastCGI, Memcached, Redis, Zabbix, and SMTP. The script uses a...

F5 Networks BIG-IP : PostgreSQL vulnerability (K23157312)

PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. CVE-2020-13692 Impact F5 does not know of any specific F5 attack vectors; however,the threat could theoretically affectsystem availability and data confidentiality. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Oracle Linux 7 : rh-postgresql10-postgresql (ELSA-2021-9428)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9428 advisory. 10.17-1 - Update to 10.17 Resolves: CVE-2021-32027 Also fixes: CVE-2021-32028 Tenable has extracted the preceding description block directly from the...

rh-postgresql10-postgresql security update

10.17-1 - Update to 10.17 Resolves: CVE-2021-32027 Also fixes: CVE-2021-32028...

The vulnerability of the PostgreSQL database management system lies in the lack of measures taken to protect SQL query structures. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of the PostgreSQL database management system is related to the lack of measures taken to protect SQL query structures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or cause service failures by using...

SUSE SLES15: libecpg6 / libpq5 / libpq5-32bit / postgresql10 / etc (SUSE-SU-2021:2777-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2777-1 advisory. - Upgrade to version 10.17: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations bsc1185924. -...

Cisco Energy Management Suite Default PostgreSQL Password Vulnerability

The version of Cisco Energy Management Suite installed on the remote host is prior to 5.2.3. It, therefore, potentially has a default password for the postgres account for the bundled PostgresSQL database. An unauthenticated, local attacker can exploit this to gain privileged or administrator...

SUSE-SU-2021:2777-1 Security update for postgresql10

This update for postgresql10 fixes the following issues: - Upgrade to version 10.17: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations bsc1185924. - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists bsc1185925. - Don't u...

PostgreSQL 11.x < 11.13 / 12.x < 12.8 / 13.x < 13.4 Memory Disclosure

The version of PostgreSQL installed on the remote host is 11 prior to 11.13, 12 prior to 12.8, or 13 prior to 13.4. As such, it is potentially affected by a memory disclosure vulnerability: - A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any...

FreeBSD : PostgreSQL server -- Memory disclosure in certain queries (b471130b-fb86-11eb-87db-6cc21735f730)

The PostgreSQL Project reports : A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include...

Information Disclosure

postgresql is vulnerable to information disclosure. A malicious query can be used to read arbitrary bytes of server memory. In the default configuration, any authenticated database user is able to exploit the vulnerability...

Ubuntu: Security Advisory (USN-5038-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...