PT-2020-4891 · Postgresql+9 · Postgresql+9
Nick Cleaton
·
Published
2020-11-11
·
Updated
2026-01-30
·
CVE-2020-25696
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
PostgreSQL versions prior to 13.1
PostgreSQL versions prior to 12.5
PostgreSQL versions prior to 11.10
PostgreSQL versions prior to 10.15
PostgreSQL versions prior to 9.6.20
PostgreSQL versions prior to 9.5.24
Description:
A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses
gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.Recommendations:
For versions prior to 13.1, update to version 13.1 or later.
For versions prior to 12.5, update to version 12.5 or later.
For versions prior to 11.10, update to version 11.10 or later.
For versions prior to 10.15, update to version 10.15 or later.
For versions prior to 9.6.20, update to version 9.6.20 or later.
For versions prior to 9.5.24, update to version 9.5.24 or later.
As a temporary workaround, consider disabling the use of
gset in interactive psql sessions until a patch is available.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Postgresql
Red Hat
Rocky Linux
Suse
Ubuntu