CVE-2020-25696

CVE-2020-25696

Name

CVE-2020-25696

Description

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
Release Notes	https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/
Issue Tracking	https://bugzilla.redhat.com/show_bug.cgi?id=1894430
Mailing List	https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html
Third Party Advisory	https://security.gentoo.org/glsa/202012-07

Type

URI

Release Notes

https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1894430

Mailing List

https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html

Third Party Advisory

https://security.gentoo.org/glsa/202012-07

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 9.5.0	< 9.5.24
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 9.6.0	< 9.6.20
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 10.0	< 10.15
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 11.0	< 11.10
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 12.0	< 12.5
`cpe:2.3:a:postgresql:postgresql::::::::`	postgresql	>= 13.0	< 13.1

CPE URI

Source package

Min version

Max version