A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql12Upgrade postgresqlUpgrade postgresql14 | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade libpq-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade postgresql-plperlUpgrade libpqUpgrade postgresql-pltclUpgrade libpq-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade postgresql-plperl-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade libpq-develUpgrade postgresql-debugsourceUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade libpq-devel-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-plpythonUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-plperl | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-testUpgrade postgresql-serverUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-develUpgrade libpq-develUpgrade libpqUpgrade postgres-decoderbufsUpgrade rh-postgresql10-postgresql-syspathsUpgrade pgauditUpgrade rh-postgresql10-postgresqlUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-contribUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresqlUpgrade postgresql-contribUpgrade postgresql-pltcl | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-test-debuginfoUpgrade pgaudit-debugsourceUpgrade libpq-develUpgrade libpqUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debuginfoUpgrade libpq-debuginfoUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-serverUpgrade pgauditUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-testUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-develUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade libpq-devel-debuginfoUpgrade postgresql-docs-debuginfoNo solution existsUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufsUpgrade libpq-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresql-upgrade | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade postgres-decoderbufsUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade postgresql-server-develUpgrade postgresql10-contribUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql96Upgrade postgresql12-contribUpgrade postgresql12Upgrade postgresql12-llvmjitUpgrade postgresql13-develUpgrade postgresql-docsUpgrade libpq5Upgrade postgresql13-server-develUpgrade postgresql10Upgrade postgresqlUpgrade postgresql-testUpgrade postgresql10-serverUpgrade postgresql96-plpythonUpgrade postgresql-pltclUpgrade postgresql10-plpythonUpgrade postgresql12-testUpgrade postgresql13-plpythonUpgrade postgresql96-serverUpgrade postgresql10-testUpgrade libecpg6-32bitUpgrade postgresql96-contribUpgrade postgresql10-develUpgrade postgresql-llvmjitUpgrade postgresql12-serverUpgrade postgresql13-testUpgrade postgresql12-docsUpgrade postgresql96-docsUpgrade postgresql-contribUpgrade postgresql13-contribUpgrade postgresql96-plperlUpgrade postgresql13-serverUpgrade postgresql13Upgrade postgresql10-plperlUpgrade libecpg6Upgrade postgresql12-develUpgrade postgresql-plpythonUpgrade postgresql10-pltclUpgrade postgresql12-plpythonUpgrade postgresql12-server-develUpgrade postgresql13-plperlUpgrade postgresql13-pltclUpgrade postgresql-develUpgrade postgresql10-docsUpgrade postgresql96-pltclUpgrade libpq5-32bitUpgrade postgresql12-pltclUpgrade postgresql12-plperlUpgrade postgresql13-docs | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-12Upgrade postgresql-10 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub