CVEvulnerability

CVE-2020-25696

7.5 HIGH Published 2020-11-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.6 HIGH — AV:N/AC:H/Au:N/C:C/I:C/A:C
Weaknesses
CWE-183, CWE-697

Description

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected configurations

• postgresql postgresql (>= 9.5.0 < 9.5.24) • postgresql postgresql (>= 9.6.0 < 9.6.20) • postgresql postgresql (>= 10.0 < 10.15) • postgresql postgresql (>= 11.0 < 11.10) • postgresql postgresql (>= 12.0 < 12.5) • postgresql postgresql (>= 13.0 < 13.1) • debian debian linux 9.0

Related

Weakness · CWE (2)

  • CWE-183 Permissive List of Allowed Inputs weakness
  • CWE-697 Incorrect Comparison weakness

References