A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql12Upgrade postgresql14Upgrade postgresql | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql96Upgrade postgresql95 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade libpqUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-docs-debuginfoUpgrade libpq-debuginfoUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade libpq-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debuginfoUpgrade pgauditUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgres-decoderbufs-debuginfoUpgrade libpq-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade libpq-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-static | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-testUpgrade postgresql-plpython | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade postgresql-docsUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-syspathsUpgrade libpq-develUpgrade libpqUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade pgauditUpgrade postgresql-upgrade-develUpgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-contribUpgrade postgresqlUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-server-develUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plperl | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoNo solution existsUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-debuginfoUpgrade libpq-devel-debuginfoUpgrade postgres-decoderbufsUpgrade libpq-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-testUpgrade pgaudit-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade pgauditUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-test-debuginfoUpgrade libpq-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgres-decoderbufs-debuginfoUpgrade libpqUpgrade postgresql-serverUpgrade postgresql-staticUpgrade libpq-debuginfoUpgrade postgresqlUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgres-decoderbufsUpgrade pgauditUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade postgresql96-contribUpgrade postgresql12-server-develUpgrade postgresql96-pltclUpgrade postgresql13-plperlUpgrade postgresql12-docsUpgrade postgresql96-docsUpgrade postgresql-contribUpgrade postgresql96-plperlUpgrade postgresql10-plperlUpgrade libecpg6Upgrade postgresql13Upgrade postgresql13-pltclUpgrade postgresql13-serverUpgrade postgresql12-pltclUpgrade postgresql13-testUpgrade postgresql-llvmjitUpgrade postgresql13-docsUpgrade postgresql-plpythonUpgrade postgresql12-serverUpgrade postgresql12-plpythonUpgrade postgresql12-develUpgrade postgresql13-contribUpgrade postgresql10-develUpgrade postgresql-develUpgrade postgresql12-plperlUpgrade postgresql10-pltclUpgrade libpq5-32bitUpgrade postgresql10-docsUpgrade postgresql-testUpgrade postgresql96-serverUpgrade postgresql12-llvmjitUpgrade postgresql10Upgrade postgresql10-plpythonUpgrade postgresql-serverUpgrade postgresql13-server-develUpgrade postgresql96Upgrade libpq5Upgrade postgresql-server-develUpgrade postgresql12-contribUpgrade postgresql-plperlUpgrade postgresql12Upgrade postgresql-docsUpgrade postgresql13-plpythonUpgrade postgresql13-develUpgrade postgresql-pltclUpgrade postgresql10-contribUpgrade postgresqlUpgrade postgresql10-serverUpgrade libecpg6-32bitUpgrade postgresql12-testUpgrade postgresql96-plpythonUpgrade postgresql10-test | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-10Upgrade postgresql-12 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub