Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0432
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0432)
Summary:	The remote host is missing an update for the 'postgresql9.6, postgresql11' package(s) announced via the MGASA-2020-0432 advisory.
Description:	Summary: The remote host is missing an update for the 'postgresql9.6, postgresql11' package(s) announced via the MGASA-2020-0432 advisory. Vulnerability Insight: A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25694) A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-25695) psql's \gset allows overwriting specially treated variables. (CVE-2020-25696) Affected Software/OS: 'postgresql9.6, postgresql11' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 7.6 CVSS Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-25694 https://security.netapp.com/advisory/ntap-20201202-0003/ https://security.gentoo.org/glsa/202012-07 https://bugzilla.redhat.com/show_bug.cgi?id=1894423 https://www.postgresql.org/support/security/ https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html Common Vulnerability Exposure (CVE) ID: CVE-2020-25695 https://bugzilla.redhat.com/show_bug.cgi?id=1894425 Common Vulnerability Exposure (CVE) ID: CVE-2020-25696 https://bugzilla.redhat.com/show_bug.cgi?id=1894430 https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.