A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresql12Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade libpq-debugsourceUpgrade postgresql-docs-debuginfoUpgrade libpq-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-test-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-debuginfoUpgrade postgresql-plperlUpgrade libpqUpgrade pgaudit-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-contrib-debuginfoUpgrade libpq-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-develUpgrade postgresql-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docsUpgrade libpq-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-devel-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-devel | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-libsUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresqlUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-staticUpgrade libpq-develUpgrade libpqUpgrade rh-postgresql10-postgresql-develUpgrade pgauditUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresqlUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgres-decoderbufs | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-server-debuginfoNo solution existsUpgrade libpq-debugsourceUpgrade postgresql-plpython3Upgrade libpq-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-upgradeUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-plperl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade libpq-debuginfoUpgrade postgresql-contribUpgrade libpqUpgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade postgres-decoderbufs-debuginfoUpgrade libpq-develUpgrade postgresql-docs | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade postgresql13-develUpgrade postgresqlUpgrade postgresql10-plpythonUpgrade postgresql-testUpgrade libecpg6-32bitUpgrade postgresql10-contribUpgrade postgresql12Upgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql12-llvmjitUpgrade postgresql10Upgrade postgresql12-testUpgrade postgresql96-serverUpgrade postgresql12-contribUpgrade postgresql96-plpythonUpgrade postgresql10-serverUpgrade postgresql-pltclUpgrade postgresql13-plpythonUpgrade postgresql13-server-develUpgrade postgresql10-testUpgrade libpq5Upgrade postgresql96Upgrade postgresql-server-develUpgrade postgresql-docsUpgrade postgresql96-plperlUpgrade postgresql12-develUpgrade postgresql10-develUpgrade postgresql12-serverUpgrade postgresql10-docsUpgrade libpq5-32bitUpgrade postgresql12-plpythonUpgrade postgresql13-pltclUpgrade postgresql-plpythonUpgrade postgresql10-pltclUpgrade postgresql10-plperlUpgrade libecpg6Upgrade postgresql-llvmjitUpgrade postgresql13-contribUpgrade postgresql12-pltclUpgrade postgresql13-testUpgrade postgresql13-docsUpgrade postgresql13-serverUpgrade postgresql12-plperlUpgrade postgresql-develUpgrade postgresql12-server-develUpgrade postgresql96-docsUpgrade postgresql13Upgrade postgresql12-docsUpgrade postgresql-contribUpgrade postgresql96-pltclUpgrade postgresql13-plperlUpgrade postgresql96-contrib | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-10Upgrade postgresql-12 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub