CVE-2020-25696 log

Severity Medium
Remote Yes
Type Arbitrary code execution
A security issue has been found in PostgreSQL before 12.5, where psql's \gset allows overwriting specially treated variables. The \gset meta-command, which sets psql variables based on query results, does not distinguish variables that control psql behavior. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. Using \gset with a prefix not found among specially treated variables, e.g. any lowercase string, precludes the attack in an unpatched psql.
Group Package Affected Fixed Severity Status Ticket
AVG-1276 postgresql 12.4-2 12.5-1 High Fixed
Date Advisory Group Package Severity Type
17 Nov 2020 ASA-202011-14 AVG-1276 postgresql High multiple issues