CVE-2020-25696
postgresql: psql's \gset allows overwriting specially treated variables
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Se encontró un fallo en el terminal interactivo psql de PostgreSQL en versiones anteriores a 13.1, anteriores a 12.5, anteriores a 11.10, anteriores a 10.15, anteriores a 9.6.20 y anteriores a 9.5.24. Si una sesión psql interactiva utiliza \gset al consultar un servidor comprometido, el atacante puede ejecutar código arbitrario como la cuenta del sistema operativo que ejecuta psql. La mayor amenaza de esta vulnerabilidad es la confidencialidad e integridad de los datos, así como también la disponibilidad del sistema
A flaw was found in the psql interactive terminal of PostgreSQL. If an interactive psql session uses \gset when querying a compromised server, this flaw allows an attacker to execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-09-16 CVE Reserved
- 2020-11-17 CVE Published
- 2024-08-04 CVE Updated
- 2024-11-16 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-183: Permissive List of Allowed Inputs
- CWE-270: Privilege Context Switching Error
- CWE-697: Incorrect Comparison
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1894430 | 2021-01-18 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202012-07 | 2023-11-07 | |
| https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2020-25696 | 2021-01-18 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 9.5.0 < 9.5.24 Search vendor "Postgresql" for product "Postgresql" and version " >= 9.5.0 < 9.5.24" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 9.6.0 < 9.6.20 Search vendor "Postgresql" for product "Postgresql" and version " >= 9.6.0 < 9.6.20" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 10.0 < 10.15 Search vendor "Postgresql" for product "Postgresql" and version " >= 10.0 < 10.15" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 11.0 < 11.10 Search vendor "Postgresql" for product "Postgresql" and version " >= 11.0 < 11.10" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 12.0 < 12.5 Search vendor "Postgresql" for product "Postgresql" and version " >= 12.0 < 12.5" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 13.0 < 13.1 Search vendor "Postgresql" for product "Postgresql" and version " >= 13.0 < 13.1" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||