CVE-2020-25696 Incorrect Comparison, Permissive List of Allowed Inputs, and Privilege Context Switching Error in PostgreSQL
Attackers can execute arbitrary code on the client machine via the psql interactive terminal when querying a compromised server using the \gset command.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-25696?
CVE-2020-25696 is a high-severity code injection vulnerability in Debian Debian Linux, published on 23 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Which versions are affected by CVE-2020-25696?
1 open source package ship an affected version, including postgresql. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 9.5.0 | 9.5.24, 9.6.20, 10.15.0, 11.10.0, 12.5.0, 13.1.0 |
Products include Debian Debian Linux, Postgresql Postgresql.
How do I fix CVE-2020-25696?
Upgrade postgresql to a fixed version for your release line: 9.5.24, 9.6.20, 10.15.0 or 11.10.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-25696 being exploited?
There is no known exploitation of CVE-2020-25696 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-25696, BIT-postgresql-2020-25696, CLEANSTART-2026-FL46674, DEBIAN-CVE-2020-25696, ECHO-29d7-c7c3-a6cc, GHSA-rfp5-6w27-jrq7 and 2 more.