Home > mailing lists

Vulnerability remediation - Mailing list pgsql-novice

From	Al Wilson
Subject	Vulnerability remediation
Date	January 3, 2024 17:03:51
Msg-id	CAH05kiyz7hnbVEEXHc3ow7288OCfK-7jAGQ1JPBnYWRftx9_JA@mail.gmail.com Whole thread Raw
Responses	Re: Vulnerability remediation
List	pgsql-novice

Does anyone have any insight on this? Perhaps point to something I can read?

Vulnerability scanner indicates "Postgres default account: postgres/no password"
Scanner states Proof as "Successfully authenticated to the Postgres service with credentials uid [postgres] pw [realm]
Application owner initially claimed that this was a false positive, but later claimed that it was resolved within the Docker instance
1. Scanner still showed vulnerability.
Found article that seemed to indicate that using the --env would address the postgres image vs. the Docker.
1. https://squaredup.com/blog/running-postgres-in-docker/
2. Scanner still shows vulnerability.
PostGres version is 9.5, if that makes a difference.

From: Ibrahim Shaame
Date: 26 November 2023, 18:18:42
Subject: Re: reporting tree into separate columns

From: Bzzzz
Date: 03 January 2024, 17:13:14
Subject: Re: Vulnerability remediation