CVE-2020-25695: SQL Injection
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. While promptly updating PostgreSQL is the best remediation for most users, a user unable to do that can work around the vulnerability by disabling autovacuum and not manually running ANALYZE, CLUSTER, REINDEX, CREATE INDEX, VACUUM FULL, REFRESH MATERIALIZED VIEW, or a restore from output of the pgdump command. Performance may degrade quickly under this workaround. VACUUM, without the FULL option, is safe, and all commands are fine when a trusted user owns the target object.
— Red Hat
PostgreSQL could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw when creating non-temporary objects in at least one schema. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary SQL functions under the identity of a superuser.
— IBM
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-25695?
CVE-2020-25695 is a vulnerability found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24 that allows an attacker to execute arbitrary SQL functions as a superuser.
What software versions are affected by CVE-2020-25695?
CVE-2020-25695 affects PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24.
What is the severity of CVE-2020-25695?
CVE-2020-25695 has a severity rating of 8.8 (high).
How can an attacker exploit CVE-2020-25695?
An attacker with permission to create non-temporary objects in at least one schema can exploit CVE-2020-25695 to execute arbitrary SQL functions as a superuser.
Are there any references for CVE-2020-25695?
Yes, you can find references for CVE-2020-25695 at the following links: [CVE-2020-25695](https://www.cve.org/CVERecord?id=CVE-2020-25695), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-25695), [Staaldraad](https://staaldraad.github.io/post/2020-12-15-cve-2020-25695-postgresql-privesc/), [PostgreSQL News](https://www.postgresql.org/about/news/postgresql-131-125-1110-1015-9620-and-9524-released-2111/), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1894425), and [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2021:1512).