Postgres Pro
Downloads
Home   >   mailing lists

RE: Tenable Report Issue even after upgrading to correct Postgres version - Mailing list pgsql-bugs

From Kishore Isaac
Subject RE: Tenable Report Issue even after upgrading to correct Postgres version
Date
Msg-id a841ecddee93431d9db48608f448b12a@GL-EXCHANGE02.loccioni.com
Whole thread Raw
In response to Re: Tenable Report Issue even after upgrading to correct Postgres version  (Dave Page <dpage@pgadmin.org>)
Responses Re: Tenable Report Issue even after upgrading to correct Postgres version
List pgsql-bugs
Tree view

Hi Dave,

 

Thanks for your response, is it possible to include the screenshots Sandeep sent?

 

Appreciate your help,

 

Kishore Isaac

 

 

Phone                         301 477 7048

Web                            www.loccioni.com

________________________________________

PRIVACY

According to International Privacy Laws the information contained in this message is confidential and of exclusive use of the addressee(s). Should you receive this message by mistake, please delete it and send a written communication to privacy@loccioni.com

Please consider the environment before printing this email

 

From: Dave Page <dpage@pgadmin.org>
Sent: Monday, November 15, 2021 5:13 AM
To: Sandeep Thakkar <sandeep.thakkar@enterprisedb.com>
Cc: David G. Johnston <david.g.johnston@gmail.com>; Bruce Momjian <bruce@momjian.us>; Kishore Isaac <k.isaac@loccioni.com>; pgsql-bugs@lists.postgresql.org
Subject: Re: Tenable Report Issue even after upgrading to correct Postgres version

 

 

 

On Mon, Nov 15, 2021 at 10:05 AM Sandeep Thakkar <sandeep.thakkar@enterprisedb.com> wrote:

Hi,

 

I installed v12.2-4 on my Windows VM, launched StackBuilder and upgraded to version v12.9-1 (the latest stable release) and the registry entry was updated. I've attached the screenshots.

 

 

Please also note that Tenable should really *not* be checking what version is installed in this way, as that info is intended for the installer (and pgAdmin, and other similar apps) for internal use and non-security related service discovery. It is easily possible for a user to update parts of the PostgreSQL installation without changing that registry value, e.g. by unpacking the zipped binary distribution over an existing installation.

 

Any security scanner worth it's salt should be examining the VERSIONINFO resource in postgres.exe to see what is actually installed (or connecting to the database server and asking it, but that might be harder).

 

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

Attachment

pgsql-bugs by date:

Previous
From: Alvaro Herrera
Date:
Subject: Re: Bogus NULL object_name from pg_event_trigger_dropped_objects()
Next
From: Thomas Munro
Date:
Subject: Re: conchuela timeouts since 2021-10-09 system upgrade