A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql12Upgrade postgresql15 | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade libpq-develUpgrade libpq-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-docsUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade libpq-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-test-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade libpq-debugsourceUpgrade postgresql-testUpgrade libpqUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsource | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-plperl | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade libpq-develUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-staticUpgrade postgresql-docsUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-syspathsUpgrade pgauditUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade libpqUpgrade postgres-decoderbufsUpgrade postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-serverUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-server-devel | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debugsourceUpgrade libpq-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-server-debuginfoNo solution existsUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade libpq-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade libpqUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgres-decoderbufs-debuginfoUpgrade libpq-develUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade libpq-debuginfoUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufsUpgrade pgauditUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfo | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade postgresql96-plpythonUpgrade postgresql-pltclUpgrade postgresql13-server-develUpgrade postgresql10Upgrade postgresql-serverUpgrade libpq5Upgrade postgresql10-testUpgrade postgresql10-serverUpgrade libecpg6-32bitUpgrade postgresql12-testUpgrade postgresqlUpgrade postgresql96-serverUpgrade postgresql13-plpythonUpgrade postgresql10-contribUpgrade postgresql-docsUpgrade postgresql96Upgrade postgresql-server-develUpgrade postgresql12Upgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql12-contribUpgrade postgresql10-plpythonUpgrade postgresql12-llvmjitUpgrade postgresql13-develUpgrade postgresql13-pltclUpgrade postgresql13-docsUpgrade postgresql13-serverUpgrade postgresql96-plperlUpgrade postgresql96-docsUpgrade postgresql12-docsUpgrade postgresql-contribUpgrade postgresql13Upgrade postgresql12-server-develUpgrade postgresql-develUpgrade postgresql12-pltclUpgrade postgresql13-testUpgrade postgresql96-pltclUpgrade postgresql13-plperlUpgrade libecpg6Upgrade postgresql10-plperlUpgrade postgresql10-develUpgrade postgresql10-docsUpgrade postgresql12-develUpgrade postgresql12-serverUpgrade postgresql12-plperlUpgrade libpq5-32bitUpgrade postgresql96-contribUpgrade postgresql-llvmjitUpgrade postgresql13-contribUpgrade postgresql-plpythonUpgrade postgresql12-plpythonUpgrade postgresql10-pltcl | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-12Upgrade postgresql-10 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub