A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresqlUpgrade postgresql14Upgrade postgresql12Upgrade postgresql15 | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade postgresql-server-debuginfoUpgrade postgresql-testUpgrade postgresql-test-rpm-macrosUpgrade libpq-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade libpq-debuginfoUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade postgresql-serverUpgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade libpqUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgresql-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-staticUpgrade postgresql-contribUpgrade libpq-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade libpq-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-docsUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-libs | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-staticUpgrade rh-postgresql10-postgresqlUpgrade postgresql-serverUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-testUpgrade postgres-decoderbufsUpgrade libpq-develUpgrade pgauditUpgrade rh-postgresql10-postgresql-syspathsUpgrade libpqUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-contribUpgrade postgresqlUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade postgresql-server-devel | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade libpqUpgrade libpq-develUpgrade postgresql-plperlUpgrade postgresql-test-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-contribUpgrade postgresql-staticUpgrade pgaudit-debugsourceUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresqlUpgrade postgresql-docsUpgrade pgauditUpgrade libpq-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docs-debuginfoUpgrade libpq-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-develUpgrade postgres-decoderbufsUpgrade libpq-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoNo solution existsUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufsUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade postgresql96Upgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql96-serverUpgrade postgresql12Upgrade postgresql13-server-develUpgrade postgresql10Upgrade libpq5Upgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql12-contribUpgrade postgresql12-testUpgrade postgresql13-plpythonUpgrade postgresqlUpgrade postgresql10-contribUpgrade postgresql13-develUpgrade postgresql12-llvmjitUpgrade postgresql10-plpythonUpgrade postgresql-pltclUpgrade postgresql96-plpythonUpgrade libecpg6-32bitUpgrade postgresql10-serverUpgrade postgresql10-testUpgrade postgresql96-docsUpgrade postgresql13-testUpgrade postgresql13-serverUpgrade postgresql12-pltclUpgrade postgresql13-docsUpgrade libecpg6Upgrade postgresql10-plperlUpgrade postgresql12-serverUpgrade postgresql13Upgrade postgresql13-contribUpgrade postgresql12-plperlUpgrade postgresql10-develUpgrade postgresql96-plperlUpgrade postgresql13-plperlUpgrade postgresql-contribUpgrade postgresql-llvmjitUpgrade postgresql96-pltclUpgrade postgresql-plpythonUpgrade libpq5-32bitUpgrade postgresql10-docsUpgrade postgresql12-plpythonUpgrade postgresql10-pltclUpgrade postgresql13-pltclUpgrade postgresql12-develUpgrade postgresql12-server-develUpgrade postgresql-develUpgrade postgresql12-docsUpgrade postgresql96-contrib | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-12Upgrade postgresql-10 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub