CVE-2020-25694 Use of a Broken or Risky Cryptographic Algorithm in PostgreSQL
Man-in-the-middle attackers can observe or modify clear-text transmissions if client applications drop security parameters during connection reuse.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25694?
CVE-2020-25694 is a high-severity vulnerability in Debian Debian Linux, published on 16 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Weakness: CWE-327
Which versions are affected by CVE-2020-25694?
2 open source packages ship an affected version, including postgresql and org.postgresql:postgresql. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | All versions | 9.5.24, 9.6.20, 10.15.0, 11.10.0, 12.5.0, 13.1.0 |
org.postgresql:postgresql Maven | All versions | 13.1 |
Products include Debian Debian Linux, Postgresql Postgresql.
How do I fix CVE-2020-25694?
Upgrade postgresql to a fixed version for your release line: 9.5.24, 9.6.20, 10.15.0 or 11.10.0.
Is CVE-2020-25694 being exploited?
There is no known exploitation of CVE-2020-25694 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-25694, BIT-postgresql-2020-25694, CLEANSTART-2026-OY05892, DEBIAN-CVE-2020-25694, ECHO-814d-438f-9a88, GHSA-vmm8-82m2-pcp5 and 2 more.