Description
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpgjava | 42.2.12-2 | — |
| Debian 13 | libpgjava | 42.2.12-2 | — |
| Debian 12 | libpgjava | 42.2.12-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libpgjava | 42.2.10-1ubuntu0.1~esm1 | USN-5238-1 |
| Ubuntu Pro 18.04 LTS | libpgjava | 9.4.1212-1ubuntu0.1~esm1 | USN-5238-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | postgresql-jdbc +1 | 42.2.3-3.el8_2 | RHSA-2020:3176 |
| RHEL 7 | postgresql-jdbc +1 | 9.2.1002-8.el7_8 | RHSA-2020:3285 |
| RHEL 6 | postgresql-jdbc | 8.4.704-4.el6_10 | RHSA-2020:3284 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.1 EUS | postgresql-jdbc +1 | 42.2.3-3.el8_1 | RHSA-2020:3286 |
| RHEL 8.0 E4S | postgresql-jdbc +1 | 42.2.3-3.el8_0 | RHSA-2020:3283 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | postgresql-jdbc +1 | 42.2.3-3.el8_2 | ALSA-2020:3176 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | postgresql-jdbc | 42.2.3-3.el8_2 | RLSA-2020:3176 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | postgresql-jdbc | 9.4-3.3.1 | SUSE-SU-2021:0599-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | postgresql-jdbc | 9.4-3.3.1 | SUSE-SU-2021:0599-1 |
| SUSE Manager Server Module 4.1 | mgr-libmod | 4.1.5-3.8.2 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | postgresql-jdbc | 42.2.10-3.3.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | python-susemanager-retail | 1.0.1605087464.65d1b51-3.6.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | saltboot-formula +1 | 0.1.1605087464.65d1b51-3.9.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacecmd | 4.1.9-4.12.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-admin | 4.1.8-3.9.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-backend | 4.1.18-4.14.6 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-certs-tools | 4.1.14-3.9.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-client-tools | 4.1.8-4.9.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-java | 4.1.24-3.19.6 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-search | 4.1.4-3.6.6 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-setup | 4.1.7-3.6.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | spacewalk-web | 4.1.21-3.12.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | supportutils-plugin-susemanager | 4.1.4-3.3.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | susemanager | 4.1.22-3.14.6 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | susemanager-docs_en +1 | 4.1-11.20.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | susemanager-frontend-libs | 4.1.1-3.6.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | susemanager-schema | 4.1.17-3.16.2 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | susemanager-sls | 4.1.18-3.16.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | susemanager-sync-data | 4.1.8-3.6.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | uyuni-cluster-provider-caasp | 4.1.3-3.3.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.1 | yomi-formula | 0.0.1+git.1604593202.a2c22bf-3.6.5 | SUSE-SU-2020:3781-1 |
| SUSE Manager Server Module 4.0 | bind-formula | 0.1.1603299886.60e4bcf-3.11.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | grafana-formula | 0.2.2-4.13.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | postgresql-jdbc | 42.2.10-3.3.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | prometheus-exporters-formula | 0.7.5-3.16.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | prometheus-formula | 0.2.3-4.16.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | salt-netapi-client | 0.18.0-4.12.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | spacewalk-admin | 4.0.12-3.15.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | spacewalk-backend | 4.0.35-3.38.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | spacewalk-java | 4.0.40-3.48.2 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | spacewalk-web | 4.0.25-3.36.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | susemanager | 4.0.32-3.46.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | susemanager-schema | 4.0.23-3.32.1 | SUSE-SU-2020:3466-1 |
| SUSE Manager Server Module 4.0 | susemanager-sls | 4.0.31-3.37.1 | SUSE-SU-2020:3466-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | java-postgresql-jdbc | 42.2.25-r0 | — |
| Alpine v3.23 | java-postgresql-jdbc | 42.2.25-r0 | — |
| Alpine v3.22 | java-postgresql-jdbc | 42.2.25-r0 | — |
| Alpine v3.21 | java-postgresql-jdbc | 42.2.25-r0 | — |
| Alpine v3.20 | java-postgresql-jdbc | 42.2.25-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | java-postgresql-jdbc | 42.2.25-r0 | — |
| Alpine v3.18 | java-postgresql-jdbc | 42.2.25-r0 | — |
| Alpine v3.17 | java-postgresql-jdbc | 42.2.25-r0 | — |
| Alpine v3.16 | java-postgresql-jdbc | 42.2.25-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | postgresql-jdbc +1 | 9.2.1002-8.amzn2 | ALAS2-2020-1482 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | postgresql-jdbc +1 | 42.2.3-3.el8_2 | ELSA-2020-3176 |
| Oracle Linux 7 | postgresql-jdbc +1 | 9.2.1002-8.el7_8 | ELSA-2020-3285 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | mariadb-10.6-test | No fix yet | — |
| Wolfi rolling | mariadb-11.2 +7 | 11.2.3-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.postgresql:postgresql | >= 9.4.1212.jre6, < 42.2.13 | 42.2.13 | GHSA-88cc-g835-76rp |
Advisories 14
- ALSA-2020:3176 Important: postgresql-jdbc security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2020:3286 Red Hat Security Advisory: postgresql-jdbc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:3284 Red Hat Security Advisory: postgresql-jdbc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:3285 Red Hat Security Advisory: postgresql-jdbc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:3283 Red Hat Security Advisory: postgresql-jdbc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:3176 Red Hat Security Advisory: postgresql-jdbc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-5238-1 libpgjava vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2020:3176 Important: postgresql-jdbc security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2021:0599-1 Security update for postgresql-jdbc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3466-1 Security update for SUSE Manager Server 4.0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3781-1 Security update for SUSE Manager Server 4.1 SUSE / openSUSE Security Updates · May 2, 2025
- ALAS2-2020-1482 Important: postgresql-jdbc security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 2, 2020
- ELSA-2020-3285 Important: postgresql-jdbc security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 4, 2020
- ELSA-2020-3176 Important: postgresql-jdbc security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 29, 2020
References
- https://github.com/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb65
- https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.13
- https://security.netapp.com/advisory/ntap-20200619-0005/
- [camel-commits] 20200723 [GitHub] [camel] mmelko opened a new pull request #4038: Update pgjdbc driver verion, that includes fix for CVE-2020-13692 mailing-list
- [camel-commits] 20200723 [GitHub] [camel] mmelko opened a new pull request #4037: Update pgjdbc driver verion, that includes fix for CVE-2020-13692 mailing-list
- [camel-commits] 20200723 [GitHub] [camel] oscerd merged pull request #4038: Update pgjdbc driver version, that includes fix for CVE-2020-13692 mailing-list
- [camel-commits] 20200723 [GitHub] [camel] oscerd merged pull request #4037: Update pgjdbc driver version, that includes fix for CVE-2020-13692 mailing-list
- [camel-commits] 20200723 [camel] branch master updated: Update pgjdbc driver version, that includes fix for CVE-2020-13692 (#4037) mailing-list
- [camel-commits] 20200723 [camel] branch camel-3.4.x updated: Update pgjdbc driver version, that includes fix for CVE-2020-13692 (#4038) mailing-list
- [camel-commits] 20200723 [GitHub] [camel] oscerd commented on pull request #4038: Update pgjdbc driver version, that includes fix for CVE-2020-13692 mailing-list
- [netbeans-notifications] 20200731 [GitHub] [netbeans] pepness opened a new pull request #2284: [NETBEANS-4664] - Upgrade JDBC PostgreSQL from 42.2.10 to 42.2.14 mailing-list
- [netbeans-notifications] 20200803 [GitHub] [netbeans] neilcsmith-net commented on pull request #2284: [NETBEANS-4664] - Upgrade JDBC PostgreSQL from 42.2.10 to 42.2.14 mailing-list
- FEDORA-2020-5a31ccfe66 vendor-advisory
- DSA-5196 vendor-advisory