A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgres-decoderbufs | May 4, 2022 | Nov 23, 2020 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresqlUpgrade postgresql14Upgrade postgresql12 | Jan 19, 2021 | Nov 23, 2020 |
| Amazon_linux | — | Upgrade postgresql95Upgrade postgresql96 | Jan 15, 2021 | Nov 17, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 23, 2020 |
| Centos_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade libpq-develUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgauditUpgrade postgresql-debugsourceUpgrade libpq-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-develUpgrade postgresql-server-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade postgresql-serverUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade libpq-debugsourceUpgrade postgresql-testUpgrade postgresql-upgradeUpgrade libpq-debuginfoUpgrade postgresql-pltclUpgrade libpqUpgrade postgresql-test-rpm-macrosUpgrade postgresqlUpgrade postgresql-plpython3-debuginfo | Dec 15, 2020 | Nov 23, 2020 |
| Debian | — | Upgrade postgresql-13 | Dec 3, 2020 | Nov 23, 2020 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Dec 7, 2020 | Nov 23, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql | Dec 15, 2020 | Nov 23, 2020 |
| Oracle_linux | — | Upgrade libpqUpgrade rh-postgresql10-postgresqlUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-pltclUpgrade libpq-develUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-syspathsUpgrade pgauditUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade postgresql-test-rpm-macrosUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-upgrade-develUpgrade postgresql-pltclUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-docsUpgrade postgresqlUpgrade rh-postgresql10-postgresql-plperlUpgrade rh-postgresql10-postgresql-libs | Dec 15, 2020 | Nov 12, 2020 |
| Postgres | — | Upgrade to PostgreSQL version 13.1 | Nov 16, 2020 | Nov 16, 2020 |
| Redhat_linux | — | Upgrade postgresql-plpython3No solution existsUpgrade postgresql-testUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-server-develUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade libpq-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade libpq-debugsourceUpgrade postgresql-server-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade libpqUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-upgrade-debuginfoUpgrade pgauditUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade libpq-debuginfoUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade libpq-develUpgrade postgresql-test-debuginfoUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-plperl | Dec 15, 2020 | Nov 23, 2020 |
| Rocky_linux | — | Upgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgauditUpgrade postgres-decoderbufsUpgrade pgaudit-debugsourceUpgrade postgres-decoderbufs-debugsource | Mar 12, 2024 | Nov 23, 2020 |
| Suse | — | Upgrade libecpg6-32bitUpgrade postgresql10-serverUpgrade postgresql96-plpythonUpgrade postgresql10-testUpgrade postgresql12-testUpgrade postgresql-pltclUpgrade postgresql13-plpythonUpgrade postgresql96-serverUpgrade libpq5Upgrade postgresql13-server-develUpgrade postgresql-serverUpgrade postgresql10Upgrade postgresql12Upgrade postgresql96Upgrade postgresql-testUpgrade postgresql12-contribUpgrade postgresql-docsUpgrade postgresql13-develUpgrade postgresqlUpgrade postgresql10-contribUpgrade postgresql-plperlUpgrade postgresql10-plpythonUpgrade postgresql12-llvmjitUpgrade postgresql-server-develUpgrade postgresql96-contribUpgrade postgresql13-plperlUpgrade postgresql10-plperlUpgrade libecpg6Upgrade postgresql-contribUpgrade postgresql96-plperlUpgrade postgresql96-docsUpgrade postgresql13Upgrade postgresql12-docsUpgrade postgresql-plpythonUpgrade libpq5-32bitUpgrade postgresql12-develUpgrade postgresql10-pltclUpgrade postgresql10-docsUpgrade postgresql12-plpythonUpgrade postgresql96-pltclUpgrade postgresql13-docsUpgrade postgresql-develUpgrade postgresql12-server-develUpgrade postgresql-llvmjitUpgrade postgresql13-pltclUpgrade postgresql10-develUpgrade postgresql13-serverUpgrade postgresql12-pltclUpgrade postgresql13-testUpgrade postgresql12-plperlUpgrade postgresql12-serverUpgrade postgresql13-contrib | Nov 25, 2020 | Nov 17, 2020 |
| Ubuntu | — | Upgrade postgresql-9.5Upgrade postgresql-10Upgrade postgresql-12 | Nov 18, 2020 | Nov 17, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub