Re: Tenable Report Issue even after upgrading to correct Postgres version

Поиск
Список
Период
Сортировка
От Dave Page
Тема Re: Tenable Report Issue even after upgrading to correct Postgres version
Дата
Msg-id CA+OCxow94OiSMv3wOm++Dzc6jFvfv-KOVocZ4qgwpU9rmvU1=w@mail.gmail.com
обсуждение исходный текст
Ответ на Re: Tenable Report Issue even after upgrading to correct Postgres version  (Sandeep Thakkar <sandeep.thakkar@enterprisedb.com>)
Ответы RE: Tenable Report Issue even after upgrading to correct Postgres version  (Kishore Isaac <k.isaac@loccioni.com>)
Список pgsql-bugs


On Mon, Nov 15, 2021 at 10:05 AM Sandeep Thakkar <sandeep.thakkar@enterprisedb.com> wrote:
Hi,

I installed v12.2-4 on my Windows VM, launched StackBuilder and upgraded to version v12.9-1 (the latest stable release) and the registry entry was updated. I've attached the screenshots.


Please also note that Tenable should really *not* be checking what version is installed in this way, as that info is intended for the installer (and pgAdmin, and other similar apps) for internal use and non-security related service discovery. It is easily possible for a user to update parts of the PostgreSQL installation without changing that registry value, e.g. by unpacking the zipped binary distribution over an existing installation.

Any security scanner worth it's salt should be examining the VERSIONINFO resource in postgres.exe to see what is actually installed (or connecting to the database server and asking it, but that might be harder).
 
--

В списке pgsql-bugs по дате отправления:

Предыдущее
От: Andrey Borodin
Дата:
Сообщение: Re: conchuela timeouts since 2021-10-09 system upgrade
Следующее
От: Michael Paquier
Дата:
Сообщение: Re: BUG #17268: Possible corruption in toast index after reindex index concurrently