CVE Vulnerability

CVE-2020-25696

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

7.6 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 4.9 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/ Release Notes Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1894430 Issue Tracking Patch
https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202012-07 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Information

Published : 2020-11-23 10:15

Updated : 2020-12-15 07:37

NVD link : CVE-2020-25696

Mitre link : CVE-2020-25696

Products Affected
No products.
CWE
CWE-183

Permissive List of Allowed Inputs

CWE-270

Privilege Context Switching Error