Vulnerability · Published Jun 4, 2020 · Assigned by mitre
CVE-2020-13692
High 7.7
In plain English
A high-severity security flaw in the postgresql-jdbc package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.7High
Exploit odds (30 days)4.1%top 9.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | postgresql-jdbc | 42.2.3-3.el8_2 | ALSA-2020:3176 |
| AlmaLinux:8 | postgresql-jdbc-javadoc | 42.2.3-3.el8_2 | ALSA-2020:3176 |
| Alpine:v3.20 | java-postgresql-jdbc | 42.2.25-r0 | ALPINE-CVE-2020-13692 |
| Alpine:v3.21 | java-postgresql-jdbc | 42.2.25-r0 | ALPINE-CVE-2020-13692 |
| Alpine:v3.22 | java-postgresql-jdbc | 42.2.25-r0 | ALPINE-CVE-2020-13692 |
| Alpine:v3.23 | java-postgresql-jdbc | 42.2.25-r0 | ALPINE-CVE-2020-13692 |
| Alpine:v3.24 | java-postgresql-jdbc | 42.2.25-r0 | ALPINE-CVE-2020-13692 |
| Debian:12 | libpgjava | 42.2.12-2 | DEBIAN-CVE-2020-13692 |
| Debian:13 | libpgjava | 42.2.12-2 | DEBIAN-CVE-2020-13692 |
| Debian:14 | libpgjava | 42.2.12-2 | DEBIAN-CVE-2020-13692 |
| Maven | org.postgresql:postgresql | 42.2.13 | GHSA-88cc-g835-76rp |
| Rocky Linux:8 | postgresql-jdbc | 0:42.2.3-3.el8_2 | RLSA-2020:3176 |
Affected products (as reported)
References
- https://github.com/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb65 x_refsource_CONFIRM
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.13 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20200619-0005/ x_refsource_CONFIRM
- [camel-commits] 20200723 [GitHub] [camel] mmelko opened a new pull request #4038: Update pgjdbc driver verion, that includes fix for CVE-2020-13692 mailing-list, x_refsource_MLIST
- [camel-commits] 20200723 [GitHub] [camel] mmelko opened a new pull request #4037: Update pgjdbc driver verion, that includes fix for CVE-2020-13692 mailing-list, x_refsource_MLIST
- [camel-commits] 20200723 [GitHub] [camel] oscerd merged pull request #4038: Update pgjdbc driver version, that includes fix for CVE-2020-13692 mailing-list, x_refsource_MLIST
- [camel-commits] 20200723 [GitHub] [camel] oscerd merged pull request #4037: Update pgjdbc driver version, that includes fix for CVE-2020-13692 mailing-list, x_refsource_MLIST
- [camel-commits] 20200723 [camel] branch master updated: Update pgjdbc driver version, that includes fix for CVE-2020-13692 (#4037) mailing-list, x_refsource_MLIST
- [camel-commits] 20200723 [camel] branch camel-3.4.x updated: Update pgjdbc driver version, that includes fix for CVE-2020-13692 (#4038) mailing-list, x_refsource_MLIST
- [camel-commits] 20200723 [GitHub] [camel] oscerd commented on pull request #4038: Update pgjdbc driver version, that includes fix for CVE-2020-13692 mailing-list, x_refsource_MLIST
- [netbeans-notifications] 20200731 [GitHub] [netbeans] pepness opened a new pull request #2284: [NETBEANS-4664] - Upgrade JDBC PostgreSQL from 42.2.10 to 42.2.14 mailing-list, x_refsource_MLIST
- [netbeans-notifications] 20200803 [GitHub] [netbeans] neilcsmith-net commented on pull request #2284: [NETBEANS-4664] - Upgrade JDBC PostgreSQL from 42.2.10 to 42.2.14 mailing-list, x_refsource_MLIST
- FEDORA-2020-5a31ccfe66 vendor-advisory, x_refsource_FEDORA
- DSA-5196 vendor-advisory, x_refsource_DEBIAN