Skip to content
OpenAdvisories
Unscored CVE-2020-25694 EUVD-2020-18355GHSA-vmm8-82m2-pcp5

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client …

Published Nov 16, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Description

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected products

VendorProductAffectedFixed
— postgresql All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 11 postgresql-13 13.1-1 —
Debian 9 postgresql-9.6 9.6.20-0+deb9u1 DLA-2478-1
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS postgresql-12 12.5-0ubuntu0.20.04.1 USN-4633-1
Ubuntu 18.04 LTS postgresql-10 10.15-0ubuntu0.18.04.1 USN-4633-1
Ubuntu 16.04 LTS postgresql-9.5 9.5.24-0ubuntu0.16.04.1 USN-4633-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS postgresql-9.3 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 8 libpq +1 12.5-1.el8_3 RHSA-2020:5401
RHEL 8 pgaudit 1.4.0-4.module+el8.3.0+9042+664538f4 RHSA-2020:5620
RHEL 8 postgres-decoderbufs 0.10.0-2.module+el8.3.0+9042+664538f4 RHSA-2020:5620
RHEL 8 postgresql +10 9.6.20-1.module+el8.3.0+8938+7f0e88b6 RHSA-2020:5620, RHSA-2020:5619, RHSA-2020:5567
RHEL 8 postgresql-upgrade +1 10.15-1.module+el8.3.0+8944+1ca16b1f RHSA-2020:5620, RHSA-2020:5567
RHEL 7 postgresql +11 9.2.24-6.el7_9 RHSA-2021:1512
RHEL 3 rh-postgresql10-postgresql +13 10.15-1.el7 RHSA-2020:5316
RHEL 3 rh-postgresql12-postgresql +13 12.5-1.el7 RHSA-2020:5317
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.2 EUS libpq +1 12.5-1.el8_2 RHSA-2021:0057
RHEL 8.2 EUS pgaudit 1.4.0-4.module+el8.2.0+9043+1dbb5661 RHSA-2021:0163
RHEL 8.2 EUS postgres-decoderbufs 0.10.0-2.module+el8.2.0+9043+1dbb5661 RHSA-2021:0163
RHEL 8.2 EUS postgresql +10 9.6.20-1.module+el8.2.0+8939+9a3b4b64 RHSA-2021:0164, RHSA-2021:0163, RHSA-2021:0161
RHEL 8.2 EUS postgresql-upgrade +1 10.15-1.module+el8.2.0+8945+21c7d5de RHSA-2021:0163, RHSA-2021:0161
RHEL 8.1 EUS libpq +1 12.5-2.el8_1 RHSA-2021:0165
RHEL 8.1 EUS postgresql +10 9.6.20-1.module+el8.1.0+9156+8ff1384f RHSA-2021:0167, RHSA-2021:0166
RHEL 8.1 EUS postgresql-upgrade +1 10.15-1.module+el8.1.0+9154+cd474635 RHSA-2021:0166
RHEL 8.0 E4S libpq +1 12.5-1.el8_0 RHSA-2020:5638
RHEL 8.0 E4S postgresql +10 9.6.20-1.module+el8.0.0+9157+356b8def RHSA-2020:5664, RHSA-2020:5661
RHEL 8.0 E4S postgresql-upgrade +1 10.15-1.module+el8.0.0+9155+4a85661a RHSA-2020:5664

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 postgres-decoderbufs 0.10.0-2.module_el8.6.0+2758+4f4474df ALSA-2020:5620

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 pgaudit 1.4.0-4.module+el8.4.0+545+ca56da2e RLSA-2020:5620
Rocky Linux 8 postgres-decoderbufs 0.10.0-2.module+el8.4.0+424+71d47d9a RLSA-2020:5620
ReleasePackageFixed inAdvisory
SLES 15 SP2 postgresql 13-4.6.7 SUSE-SU-2021:0175-1
SLES 15 SP2 postgresql10 10.15-8.22.1 SUSE-SU-2020:3476-1
SLES 15 SP2 postgresql12 12.5-8.10.1 SUSE-SU-2020:3463-1
SLES 15 SP2 postgresql13 13.1-5.3.15 SUSE-SU-2021:0175-1
SLES 15 SP1 postgresql10 10.15-8.22.1 SUSE-SU-2020:3476-1
SLES 15 SP1 postgresql12 12.5-3.15.1 SUSE-SU-2020:3425-1
SLES 15 postgresql10 10.15-4.28.1 SUSE-SU-2020:3455-1
SLES 12 SP5 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES 12 SP5 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES 12 SP5 postgresql12 12.5-3.9.3 SUSE-SU-2021:0217-1, SUSE-SU-2020:3630-1
SLES 12 SP5 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SLES 12 SP4 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES 12 SP4 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES 12 SP4 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SLES 12 SP4 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP3 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES 12 SP3 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES 12 SP3 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SLES 12 SP3 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SLES 12 SP3 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SLES 12 SP2 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES 12 SP2 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES 12 SP2 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SLES 12 SP2 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SLES 12 SP2 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SLES for SAP 15 postgresql10 10.15-4.28.1 SUSE-SU-2020:3455-1
SLES for SAP 12 SP5 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP5 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES for SAP 12 SP5 postgresql12 12.5-3.9.3 SUSE-SU-2021:0217-1, SUSE-SU-2020:3630-1
SLES for SAP 12 SP5 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP4 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP4 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES for SAP 12 SP4 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SLES for SAP 12 SP4 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP3 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP3 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES for SAP 12 SP3 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SLES for SAP 12 SP3 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP3 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SLES for SAP 12 SP2 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP2 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SLES for SAP 12 SP2 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SLES for SAP 12 SP2 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SLES for SAP 12 SP2 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SLE HPC 15 postgresql10 10.15-4.28.1 SUSE-SU-2020:3455-1
SUSE OpenStack Cloud Crowbar 9 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud Crowbar 9 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SUSE OpenStack Cloud Crowbar 9 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SUSE OpenStack Cloud Crowbar 9 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud Crowbar 8 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud Crowbar 8 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SUSE OpenStack Cloud Crowbar 8 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SUSE OpenStack Cloud Crowbar 8 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud Crowbar 8 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SUSE OpenStack Cloud 9 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud 9 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SUSE OpenStack Cloud 9 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SUSE OpenStack Cloud 9 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud 8 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud 8 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SUSE OpenStack Cloud 8 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SUSE OpenStack Cloud 8 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud 8 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SUSE OpenStack Cloud 7 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud 7 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SUSE OpenStack Cloud 7 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SUSE OpenStack Cloud 7 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SUSE OpenStack Cloud 7 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SUSE HPE Helion OpenStack 8 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SUSE HPE Helion OpenStack 8 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SUSE HPE Helion OpenStack 8 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SUSE HPE Helion OpenStack 8 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SUSE HPE Helion OpenStack 8 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
SUSE Enterprise Storage 5 postgresql 13-4.7.1 SUSE-SU-2021:0217-1
SUSE Enterprise Storage 5 postgresql10 10.15-4.9.1 SUSE-SU-2020:3464-1
SUSE Enterprise Storage 5 postgresql12 12.5-3.9.3 SUSE-SU-2020:3630-1
SUSE Enterprise Storage 5 postgresql13 13.1-3.3.1 SUSE-SU-2021:0217-1
SUSE Enterprise Storage 5 postgresql96 9.6.20-6.8.1 SUSE-SU-2020:3477-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed postgresql10 10.18-1.3 openSUSE-SU-2024:11184-1
openSUSE Tumbleweed postgresql11 11.13-1.3 openSUSE-SU-2024:11185-1
openSUSE Tumbleweed postgresql12 12.8-1.3 openSUSE-SU-2024:11186-1
openSUSE Tumbleweed postgresql13 13.4-1.3 openSUSE-SU-2024:11187-1
openSUSE Tumbleweed postgresql14 14.5-2.1 openSUSE-SU-2024:12387-1
openSUSE Tumbleweed postgresql15 15.4-2.1 openSUSE-SU-2024:13243-1
openSUSE Tumbleweed postgresql16 16.4-1.1 openSUSE-SU-2024:14360-1
openSUSE Tumbleweed postgresql17 17.6-2.1 openSUSE-SU-2025:15580-1
openSUSE Leap 15.2 postgresql 13-lp152.3.6.1 openSUSE-SU-2021:0337-1
openSUSE Leap 15.2 postgresql10 10.15-lp152.2.9.1 openSUSE-SU-2020:2019-1
openSUSE Leap 15.2 postgresql12 12.5-lp152.3.10.1 openSUSE-SU-2020:2018-1
openSUSE Leap 15.1 postgresql10 10.15-lp151.2.21.1 openSUSE-SU-2020:2028-1
openSUSE Leap 15.1 postgresql12 12.5-lp151.10.1 openSUSE-SU-2020:2029-1
ReleasePackageFixed inAdvisory
Alpine v3.20 postgresql14 +1 12.5-r0 —
Alpine v3.19 postgresql14 +1 12.5-r0 —
Alpine v3.18 postgresql12 +2 12.5-r0 —
Alpine v3.17 postgresql12 +2 12.5-r0 —
Alpine v3.16 postgresql12 +1 12.5-r0 —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.15 postgresql12 +1 12.5-r0 —
Alpine v3.14 postgresql 12.5-r0 —
Alpine v3.13 postgresql 12.5-r0 —
Alpine v3.12 postgresql 12.5-r0 —
Alpine v3.11 postgresql 12.5-r0 —
Alpine v3.10 postgresql 11.10-r0 —
Alpine v3.9 postgresql 11.10-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 postgresql +11 9.2.24-6.amzn2 ALAS2-2021-1665

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 libpq +1 12.5-1.el8_3 ELSA-2020-5401
Oracle Linux 7 postgresql +11 9.2.24-6.el7_9 ELSA-2021-1512
Oracle Linux 7 rh-postgresql10-postgresql +13 10.15-1.el7 ELSA-2021-9290

Advisories 48

References