CVE-2020-25694: High severity IBM Analytics Content Hub vulnerability
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Many PostgreSQL-provided client applications have options that create additional database connections. Some of those applications reuse only the basic connection parameters (e.g. host, user, port), dropping others. If this drops a security-relevant parameter (e.g. channelbinding, sslmode, requirepeer, gssencmode), the attacker has an otherwise-unavailable opportunity to complete a man-in-the-middle attack or observe cleartext transmission. Affected applications are clusterdb, pgdump, pgrestore, psql, reindexdb, and vacuumdb. The vulnerability arises only if one invokes an affected client application with a connection string containing a security-relevant parameter.
Supported, Vulnerable Versions: 9.5 - 13.
— Red Hat
PostgreSQL could allow a remote attacker to obtain sensitive information, caused by the use of clear-text transmissions when reusing the basic connection parameters while dropping security-relevant parameters. By using man-in-the-middle attack techniques, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 0:9.2.24-6.el7_9 - Upgrade
Upgrade
redhat/libpqto a version that resolves this vulnerability.Fixed in 0:12.5-1.el8_3 - Upgrade
Upgrade
redhat/libpqto a version that resolves this vulnerability.Fixed in 0:12.5-1.el8_0 - Upgrade
Upgrade
redhat/libpqto a version that resolves this vulnerability.Fixed in 0:12.5-2.el8_1 - Upgrade
Upgrade
redhat/libpqto a version that resolves this vulnerability.Fixed in 0:12.5-1.el8_2 - Upgrade
Upgrade
redhat/rh-postgresql10-postgresqlto a version that resolves this vulnerability.Fixed in 0:10.15-1.el7 - Upgrade
Upgrade
redhat/rh-postgresql12-postgresqlto a version that resolves this vulnerability.Fixed in 0:12.5-1.el7 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 13.1 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 12.5 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 11.10 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 10.15 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.6.20 - Upgrade
Upgrade
redhat/postgresqlto a version that resolves this vulnerability.Fixed in 9.5.24 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 13.1 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 12.5 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 11.10 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 10.15 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.6.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.5.24
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-25694?
CVE-2020-25694 is a vulnerability found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.
What is the severity of CVE-2020-25694?
CVE-2020-25694 has a severity score of 8.1, which is considered high.
How does CVE-2020-25694 affect PostgreSQL?
CVE-2020-25694 affects PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.
How can I fix CVE-2020-25694?
To fix CVE-2020-25694, upgrade to PostgreSQL version 13.1, 12.5, 11.10, 10.15, or 9.6.20.
Where can I find more information about CVE-2020-25694?
You can find more information about CVE-2020-25694 in the Red Hat Bugzilla references: https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1897234, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1897231, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1897222.