UBUNTU-CVE-2020-25696

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2020-25696

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-25696.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-25696

Related

Published

2020-11-13T00:00:00Z

Modified

2024-10-15T14:07:39Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

References

Affected packages

Ubuntu:Pro:14.04:LTS / postgresql-9.3

Package

Name: postgresql-9.3
Purl: pkg:deb/ubuntu/postgresql-9.3?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.3.1-1

9.3.2-1

9.3.2-1ubuntu1

9.3.2-1ubuntu2

9.3.3-1

9.3.3-1bzr1

9.3.3-1bzr2

9.3.4-1

9.3.5-0ubuntu0.14.04.1

9.3.6-0ubuntu0.14.04

9.3.7-0ubuntu0.14.04

9.3.8-0ubuntu0.4.04

9.3.9-0ubuntu0.14.04

9.3.10-0ubuntu0.14.04

9.3.11-0ubuntu0.14.04

9.3.12-0ubuntu0.14.04

9.3.13-0ubuntu0.14.04

9.3.14-0ubuntu0.14.04

9.3.15-0ubuntu0.14.04

9.3.16-0ubuntu0.14.04

9.3.17-0ubuntu0.14.04

9.3.18-0ubuntu0.14.04.1

9.3.19-0ubuntu0.14.04

9.3.20-0ubuntu0.14.04

9.3.21-0ubuntu0.14.04

9.3.22-0ubuntu0.14.04

9.3.23-0ubuntu0.14.04

9.3.24-0ubuntu0.14.04

9.3.24-0ubuntu0.14.04+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:16.04:LTS / postgresql-9.5

Package

Name: postgresql-9.5
Purl: pkg:deb/ubuntu/postgresql-9.5?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.5.24-0ubuntu0.16.04.1

Affected versions

9.*

9.5.0-1

9.5.0-2

9.5.0-3

9.5.1-1

9.5.2-1

9.5.3-0ubuntu0.16.04

9.5.4-0ubuntu0.16.04

9.5.5-0ubuntu0.16.04

9.5.6-0ubuntu0.16.04

9.5.7-0ubuntu0.16.04

9.5.8-0ubuntu0.16.04.1

9.5.9-0ubuntu0.16.04

9.5.10-0ubuntu0.16.04

9.5.11-0ubuntu0.16.04

9.5.12-0ubuntu0.16.04

9.5.13-0ubuntu0.16.04

9.5.14-0ubuntu0.16.04

9.5.16-0ubuntu0.16.04.1

9.5.17-0ubuntu0.16.04.1

9.5.18-0ubuntu0.16.04.1

9.5.19-0ubuntu0.16.04.1

9.5.21-0ubuntu0.16.04.1

9.5.23-0ubuntu0.16.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libecpg-compat3"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libecpg-compat3-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libecpg-dev"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libecpg-dev-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libecpg6"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libecpg6-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libpgtypes3"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libpgtypes3-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libpq-dev"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libpq-dev-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libpq5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "libpq5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-9.5-dbg"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-9.5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-client-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-client-9.5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-contrib-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-contrib-9.5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-doc-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-plperl-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-plperl-9.5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-plpython-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-plpython-9.5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-plpython3-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-plpython3-9.5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-pltcl-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-pltcl-9.5-dbgsym"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-server-dev-9.5"
        },
        {
            "binary_version": "9.5.24-0ubuntu0.16.04.1",
            "binary_name": "postgresql-server-dev-9.5-dbgsym"
        }
    ]
}

Ubuntu:18.04:LTS / postgresql-10

Package

Name: postgresql-10
Purl: pkg:deb/ubuntu/postgresql-10?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

10.15-0ubuntu0.18.04.1

Affected versions

10.*

10.1-1

10.1-2

10.2-1

10.3-1

10.4-0ubuntu0.18.04

10.5-0ubuntu0.18.04

10.6-0ubuntu0.18.04.1

10.7-0ubuntu0.18.04.1

10.8-0ubuntu0.18.04.1

10.9-0ubuntu0.18.04.1

10.10-0ubuntu0.18.04.1

10.12-0ubuntu0.18.04.1

10.14-0ubuntu0.18.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libecpg-compat3"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libecpg-compat3-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libecpg-dev"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libecpg-dev-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libecpg6"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libecpg6-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libpgtypes3"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libpgtypes3-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libpq-dev"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libpq5"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "libpq5-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-10-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-client-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-client-10-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-doc-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-plperl-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-plperl-10-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-plpython-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-plpython-10-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-plpython3-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-plpython3-10-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-pltcl-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-pltcl-10-dbgsym"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-server-dev-10"
        },
        {
            "binary_version": "10.15-0ubuntu0.18.04.1",
            "binary_name": "postgresql-server-dev-10-dbgsym"
        }
    ]
}

Ubuntu:20.04:LTS / postgresql-12

Package

Name: postgresql-12
Purl: pkg:deb/ubuntu/postgresql-12?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

12.5-0ubuntu0.20.04.1

Affected versions

12.*

12.0-1

12.1-1

12.1-2build1

12.2-1

12.2-1ubuntu2

12.2-4

12.4-0ubuntu0.20.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libecpg-compat3"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libecpg-compat3-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libecpg-dev"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libecpg-dev-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libecpg6"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libecpg6-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libpgtypes3"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libpgtypes3-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libpq-dev"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libpq5"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "libpq5-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-12"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-12-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-client-12"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-client-12-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-doc-12"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-plperl-12"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-plperl-12-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-plpython3-12"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-plpython3-12-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-pltcl-12"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-pltcl-12-dbgsym"
        },
        {
            "binary_version": "12.5-0ubuntu0.20.04.1",
            "binary_name": "postgresql-server-dev-12"
        }
    ]
}