A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql12Upgrade postgresqlUpgrade postgresql14 | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade libpq-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-staticUpgrade pgauditUpgrade postgresql-contribUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docsUpgrade libpq-devel-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade libpq-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade libpqUpgrade pgaudit-debuginfoUpgrade postgresql-serverUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-plperl-debuginfoUpgrade libpq-debugsourceUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-plpython3-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-pltcl | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-testUpgrade postgresql-docsUpgrade postgresql-serverUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade libpq-develUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-pltclUpgrade pgauditUpgrade rh-postgresql10-postgresql-syspathsUpgrade libpqUpgrade postgresql-staticUpgrade postgres-decoderbufs | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade pgauditUpgrade libpq-debuginfoUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-test-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade libpq-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperlUpgrade libpqUpgrade postgresql-serverUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceNo solution existsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-plpython3Upgrade postgresql-server-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade libpq-debugsourceUpgrade libpq-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltcl-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade postgresql13-develUpgrade postgresql10-contribUpgrade postgresql96-plpythonUpgrade postgresql-docsUpgrade postgresql10-testUpgrade postgresql-pltclUpgrade postgresql13-plpythonUpgrade postgresqlUpgrade libecpg6-32bitUpgrade postgresql12Upgrade postgresql10-plpythonUpgrade libpq5Upgrade postgresql12-llvmjitUpgrade postgresql10Upgrade postgresql-serverUpgrade postgresql10-serverUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql12-testUpgrade postgresql12-contribUpgrade postgresql96-serverUpgrade postgresql96Upgrade postgresql13-server-develUpgrade postgresql10-docsUpgrade postgresql13-plperlUpgrade postgresql-llvmjitUpgrade postgresql12-serverUpgrade postgresql-plpythonUpgrade postgresql10-pltclUpgrade postgresql10-develUpgrade postgresql12-plpythonUpgrade postgresql96-contribUpgrade postgresql96-pltclUpgrade postgresql13-pltclUpgrade postgresql96-docsUpgrade postgresql96-plperlUpgrade libpq5-32bitUpgrade postgresql12-server-develUpgrade postgresql13-serverUpgrade postgresql12-plperlUpgrade postgresql12-pltclUpgrade postgresql13-docsUpgrade postgresql13-testUpgrade postgresql13-contribUpgrade libecpg6Upgrade postgresql10-plperlUpgrade postgresql12-docsUpgrade postgresql-contribUpgrade postgresql13Upgrade postgresql-develUpgrade postgresql12-devel | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-12Upgrade postgresql-9.5 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub