Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dR2nI-0003vU-E0 for pgsql-admin@arkaria.postgresql.org; Fri, 30 Jun 2017 20:45:36 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1dR2nG-000526-Sm for pgsql-admin@arkaria.postgresql.org; Fri, 30 Jun 2017 20:45:34 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1dR2nF-000517-Tq for pgsql-admin@postgresql.org; Fri, 30 Jun 2017 20:45:33 +0000 Received: from 104-190-1-44.lightspeed.sndgca.sbcglobal.net ([104.190.1.44] helo=joeconway.com) by magus.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dR2nC-0005ey-Iw for pgsql-admin@postgresql.org; Fri, 30 Jun 2017 20:45:33 +0000 Received: from [72.214.29.243] (account jconway@joeconway.com HELO [192.168.4.41]) by joeconway.com (CommuniGate Pro SMTP 6.1.4) with ESMTPSA id 18806924; Fri, 30 Jun 2017 13:45:25 -0700 Subject: Re: Postgres vs EnterpriseDB Vulnerability scans with Nessus To: "Goldsmith, Christopher [ASM Research]" , "pgsql-admin@postgresql.org" References: From: Joe Conway Openpgp: id=4EA5B4659ED59CC9538139A5332B7E68B699434A Message-ID: <314b48fc-ae41-eaee-3c54-49e1d3bc355b@joeconway.com> Date: Fri, 30 Jun 2017 13:45:24 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.1.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="50dM7WapkrBfrea6s8g7Uk3AImetEWaSj" List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --50dM7WapkrBfrea6s8g7Uk3AImetEWaSj From: Joe Conway To: "Goldsmith, Christopher [ASM Research]" , "pgsql-admin@postgresql.org" Message-ID: <314b48fc-ae41-eaee-3c54-49e1d3bc355b@joeconway.com> Subject: Re: [ADMIN] Postgres vs EnterpriseDB Vulnerability scans with Nessus References: In-Reply-To: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Content-Language: en-US On 06/30/2017 09:29 AM, Goldsmith, Christopher [ASM Research] wrote: > We are using Nessus Version: 5.5.0 to run Vulnerability scans of our > EnterpriseDB 9.5..x instances and Nessus is using up-to-date Postgres > audit file/ policy / definitions. >=20 > Is there anyone here that uses EnterpriseDB fork of Postgres and can > confirm if the EnterpriseDB and Postgres are close enough that the > results are valid and can be trusted. EDB is a proprietary fork with unknown modifications (i.e. we on this list don't have access to their source code), thus I think only EDB can answer that question. You should be asking them. Joe --=20 Crunchy Data - http://crunchydata.com PostgreSQL Support for Secure Enterprises Consulting, Training, & Open Source Development --50dM7WapkrBfrea6s8g7Uk3AImetEWaSj Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJZVrhkAAoJEDfy90M199hlAKkP/jzLUCFx9CEiD9d+WTs4Gxo6 9Br7D9r5pFRqrw1/yscD5sLB83MCyUBgRj//Gk+h79i9pD7fKkORGUwuu65DQXgW Y8xbAG4HCzl08cFCrvfagfWkCt22wkAVXAHFZMTNuB4SbWzf2sBearpGHm0bPf+J 5u/SMhIHyCP50ZtsS2YssPCAHqQAQJRZuKYwHEYJ97MjdwefhJg/Tjem2nfcvJuH EdGMWk1C23bQ2/UAy7o3Ekya8XUHvTDhb0fh2O7VekX4qo0OL1pXf15NfsGPLJ45 2l5Yg/wFBi3XZDj+w36s2Pd1jO8+uLKVDKoCic5rshsnroBRxxFlQzPfTUBsBRKM BOxaETzK+V/q9Ge/NpWMqHrw9WHoibVwqdgCEiG6Iz5Fkd6piCLbJyys3Je38XkV ukvYWk2ZEM6vSDPvh+RA9gbLzsy+VKjtLLP8lMfhX95rd8ggSZIISZqPpaWjMYkz yQKO7RPZ0Vfiuyg0nzWChrvbfrCiXUTqL8YdD6evQOJdG6ROg0SJVJsjA0XmGhwV s1EBXvs65tHQJD8id7zZZ2/8/HEfTZbJYC1c8//MdyUBeLG0uBKbc3z48BKtNsWZ Tjwnl3e5PtJsvZuRYyUb2neTG9UwR8ohsTjPZf08ktpDg+2GmMT1Rw2M+w/1O1Z2 lyAHftG+QjNMR6r2M6sD =H438 -----END PGP SIGNATURE----- --50dM7WapkrBfrea6s8g7Uk3AImetEWaSj--