PT-2020-6672 · Postgresql+9 · Postgresql Jdbc Driver+9

Published 2020-06-01 · Updated 2024-03-06 · CVE-2020-13692

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:M/Au:N/C:C/I:P/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL JDBC Driver (aka PgJDBC) versions prior to 42.2.13

Description The issue is related to the incorrect restriction of XML external entities, which can lead to XXE attacks. A remote attacker can exploit this to conduct XXE attacks.

Recommendations For versions prior to 42.2.13, update to version 42.2.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of external entities in XML parsing until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

ALSA-2020:3176

ALT-PU-2023-8463

BDU:2022-03872

BIT-POSTGRESQL-JDBC-DRIVER-2020-13692

CESA-2020_3176

CESA-2020_3284

CESA-2020_3285

CVE-2020-13692

DSA-5196-1

GHSA-88CC-G835-76RP

MGASA-2020-0319

RHSA-2020:3176

RHSA-2020:3283

RHSA-2020:3284

RHSA-2020:3285

RHSA-2020:3286

RHSA-2020_3176

RHSA-2020_3284

RHSA-2020_3285

RLSA-2020:3176

SUSE-SU-2020:3466-1

SUSE-SU-2020:3781-1

SUSE-SU-2021:0599-1

SUSE-SU-2021_0599-1

USN-5238-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Postgresql Jdbc Driver

Red Hat

Rocky Linux

Suse

Ubuntu

References · 91

• https://github.com/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb65 · Patch
• https://ubuntu.com/security/CVE-2020-13692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13692 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:3781-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3176.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC · Vendor Advisory
• https://debian.org/security/2022/dsa-5196 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2020:3176 · Vendor Advisory
• https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.13 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:3176 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3285.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0319.html · Security Note
• https://osv.dev/vulnerability/USN-5238-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13692 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03872 · Security Note