When updates are applied to PostgreSQL software, any software components that have been replaced or made unnecessary must be removed.

From PostgreSQL 9.x Security Technical Implementation Guide

Associated with: CCI-002617

SV-87569r1_rule When updates are applied to PostgreSQL software, any software components that have been replaced or made unnecessary must be removed.

Vulnerability discussion

Previous versions of PostgreSQL components that are not removed from the information system after updates have been installed may be exploited by adversaries.Some PostgreSQL installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules.A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.

Check content

To check software installed by packages, as the system administrator, run the following command: # RHEL/CENT Systems $ sudo rpm -qa | grep postgres If multiple versions of postgres are installed but are unused, this is a finding.

Fix text

Use package managers (RPM or apt-get) for installing PostgreSQL. Unused software is removed when updated.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.