XML External Entity injection in Postgresql JDBC Driver - CVE-2020-13692

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41479

XML External Entity injection in Postgresql JDBC Driver - CVE-2020-13692

Published: August 10, 2020


Vulnerability identifier: #VU41479
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-13692
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.


Affected software

Postgresql JDBC Driver
Amazon Linux AMI
CentOS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Fedora
IBM Security Verify Governance
InfoSphere Data Replication
Data Computing Appliance (DCA)
watsonx.data
postgresql-jdbc (Red Hat package)
libpgjava (Debian package)
postgresql-jdbc
Dell EMC NetWorker vProxy

How to mitigate CVE-2020-13692

Install updates from vendor's website.

Postgresql JDBC Driver - update to 42.2.13
IBM Security Verify Governance - update to 10.0.1.0.3
watsonx.data - update to 2.0.2
Data Computing Appliance (DCA) - update to 4.3.0.0
postgresql-jdbc (Red Hat package) - addressed in versions 8.4.704-4.el6_10, 9.2.1002-8.el7_8, 42.2.3-3.el8_0, 42.2.3-3.el8_1, 42.2.3-3.el8_2
Dell EMC NetWorker vProxy - addressed in versions 19.2.1.4, 19.3.04, 19.4
libpgjava (Debian package) - addressed in versions 42.2.5-2+deb10u1, 42.2.15-1+deb11u1
postgresql-jdbc - update to 42.2.12-2.fc32

External References

Related Security Bulletins