CVE-2020-25695 SQL Injection
An attacker with object creation permissions can execute arbitrary SQL as a superuser, compromising data confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25695?
CVE-2020-25695 is a high-severity vulnerability in Debian Debian Linux, published on 16 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Weakness: CWE-89
Which versions are affected by CVE-2020-25695?
2 open source packages ship an affected version, including postgresql and org.postgresql:postgresql. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | All versions | 9.5.24, 9.6.20, 10.15.0, 11.10.0, 12.5.0, 13.1.0 |
org.postgresql:postgresql Maven | All versions | 13.1 |
Products include Debian Debian Linux, Postgresql Postgresql.
How do I fix CVE-2020-25695?
Upgrade postgresql to a fixed version for your release line: 9.5.24, 9.6.20, 10.15.0 or 11.10.0.
Is CVE-2020-25695 being exploited?
There is no known exploitation of CVE-2020-25695 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-25695, BIT-postgresql-2020-25695, CLEANSTART-2026-GV19104, DEBIAN-CVE-2020-25695, ECHO-fd80-3772-5fd8, GHSA-xgxp-9x8p-gcw4 and 2 more.