PostgreSQL on Windows is detected with the wrong version (OID: 1.3.6.1.4.1.25623.1.0.148597)

Vulnerability Tests
1

Downloading the official installer for Windows linked on the PostgreSQL webseite postgresql-14.5-1-windows-x64.exe and installing PostgreSQL 14.5 results in Greenbone detecting the wrong version and thus resulting in a false positive for the check:

PostgreSQL 10.x < 10.22, 11.x < 11.17, 12.x < 12.12, 13.x < 13.8, 14.x…
OID: 1.3.6.1.4.1.25623.1.0.148597

Greenbone result is:

Installed version: 14.0.5.22220
Fixed version: 14.5
Installation
path / port: C:\Program Files\PostgreSQL\14

SELECT version(); on the database reports PostgreSQL 14.5, the file properties on Windows have

Fileversion: 14.0.5.22220
Productversion: 14.5

so it appears the check is falsely checking Fileversion instead of Productversion.

2 Likes
2

Thanks a lot for your posting.

There might be a reason why the dev had chosen to use Fileversion instead of Productversion in the past (e.g. Productversion was empty / not set for older versions of PostgreSQL and Fileversion contained the expected version). Switching the extraction from Fileversion to Productversion could cause other problems in that case.

Nevertheless i have created an internal ticket for the team working on this topic to evaluate / check the PostgreSQL detection.

1 Like
3

To follow-up to this the detection has been updated to use Product version instead of File version and the changes should be already in the recent feeds.

As a background:

In PostgreSQL 9.6.x the Product version was 9.6.24 with the File version having 9.6.24.21312, that was probably the reason why the more detailed File version had been used in the past.

But it seem starting from a least PostgreSQL 11.x the Product version is now 11.17 while the File version versioning scheme had changed to 11.0.17.22220 which caused problems for version checks checking for e.g. < 11.17.

1 Like