Skip to content
OpenAdvisories
Unscored USN-4633-1 3 CVEs

postgresql-10, postgresql-12, postgresql-9.5 vulnerabilities

Published Nov 17, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Peter Eisentraut discovered that PostgreSQL incorrectly handled connection
security settings. Client applications could possibly be connecting with
certain security parameters dropped, contrary to expectations.
(CVE-2020-25694)

Etienne Stalmans discovered that PostgreSQL incorrectly handled the
security restricted operation sandbox. An authenticated remote attacker
could possibly use this issue to execute arbitrary SQL functions as a
superuser. (CVE-2020-25695)

Nick Cleaton discovered that PostgreSQL incorrectly handled the \gset
meta-command. A remote attacker with a compromised server could possibly
use this issue to execute arbitrary code. (CVE-2020-25696)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS postgresql-9.5 9.5.24-0ubuntu0.16.04.1
Ubuntu · 18.04 LTS 18.04:LTS postgresql-10 10.15-0ubuntu0.18.04.1
Ubuntu · 20.04 LTS 20.04:LTS postgresql-12 12.5-0ubuntu0.20.04.1

Vulnerabilities 3

References

  • report
    https://ubuntu.com/security/CVE-2020-25694
  • report
    https://ubuntu.com/security/CVE-2020-25695
  • report
    https://ubuntu.com/security/CVE-2020-25696