A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql12Upgrade postgresql14Upgrade postgresql | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade libpq-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-pltclUpgrade libpqUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-server-develUpgrade postgresql-test-debuginfoUpgrade libpq-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade libpq-develUpgrade postgresql-debugsourceUpgrade pgauditUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade libpq-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-libsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-docs | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade postgresql-pltclUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresqlUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade postgres-decoderbufsUpgrade pgauditUpgrade rh-postgresql10-postgresql-testUpgrade libpq-develUpgrade rh-postgresql10-postgresql-develUpgrade libpqUpgrade rh-postgresql10-postgresqlUpgrade postgresql-docsUpgrade postgresql-static | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade pgauditUpgrade libpq-debuginfoUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade libpq-develUpgrade libpqUpgrade postgresql-serverUpgrade postgres-decoderbufs-debuginfoUpgrade postgresqlUpgrade postgresql-test-debuginfoUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfoUpgrade postgresql-server-debuginfoNo solution existsUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade libpq-devel-debuginfoUpgrade postgresql-plpython3Upgrade libpq-debugsource | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade pgauditUpgrade postgres-decoderbufsUpgrade pgaudit-debuginfo | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade postgresql13Upgrade postgresql96-plperlUpgrade postgresql12-docsUpgrade postgresql-contribUpgrade postgresql12-serverUpgrade postgresql96-pltclUpgrade postgresql12-plperlUpgrade postgresql12-plpythonUpgrade postgresql96-contribUpgrade postgresql13-contribUpgrade postgresql-llvmjitUpgrade postgresql13-plperlUpgrade postgresql13-testUpgrade postgresql13-serverUpgrade postgresql12-pltclUpgrade postgresql12-develUpgrade libpq5-32bitUpgrade postgresql13-docsUpgrade postgresql10-docsUpgrade postgresql10-pltclUpgrade postgresql-develUpgrade postgresql96-docsUpgrade postgresql13-pltclUpgrade postgresql12-server-develUpgrade libecpg6Upgrade postgresql10-plperlUpgrade postgresql-plpythonUpgrade postgresql10-develUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql12Upgrade postgresql13-plpythonUpgrade postgresql-pltclUpgrade postgresql96-serverUpgrade postgresql10Upgrade postgresql12-testUpgrade libpq5Upgrade postgresqlUpgrade postgresql13-develUpgrade postgresql10-contribUpgrade postgresql10-serverUpgrade postgresql10-testUpgrade postgresql-docsUpgrade libecpg6-32bitUpgrade postgresql12-llvmjitUpgrade postgresql10-plpythonUpgrade postgresql96-plpythonUpgrade postgresql13-server-develUpgrade postgresql12-contribUpgrade postgresql96Upgrade postgresql-test | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-10Upgrade postgresql-12 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub