Fluid Attacks Database

Description

Improper Restriction of XML External Entity Reference PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	libpgjava	>=0 <42.2.12-2	42.2.12-2
debian 12	libpgjava	>=0 <42.2.12-2	42.2.12-2
maven	org.postgresql:postgresql	>=9.4.1212.jre6 <42.2.13	42.2.13
debian 13	libpgjava	>=0 <42.2.12-2	42.2.12-2
rpm rhel6	postgresql-jdbc	<0:8.4.704-4.el6_10	0:8.4.704-4.el6_10
rpm rhel7	postgresql-jdbc	<0:9.2.1002-8.el7_8	0:9.2.1002-8.el7_8
rpm rhel8	postgresql-jdbc	<0:42.2.3-3.el8_2	0:42.2.3-3.el8_2
rpm rhel8.1	postgresql-jdbc	<0:42.2.3-3.el8_1	0:42.2.3-3.el8_1

Aliases

1. CVE-2020-136922. NVD-2020-136923. OSV-DEBIAN-2020-136924. OSV-2020-136925. GCVE-2020-136926. SECURITY-TRACKER-CVE-2020-13692

References

1. https://github.com/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb652. https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.133. https://lists.apache.org/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb@%3Ccommits.camel.apache.org%3E4. https://lists.apache.org/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e@%3Ccommits.camel.apache.org%3E5. https://lists.apache.org/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0@%3Ccommits.camel.apache.org%3E6. https://lists.apache.org/thread.html/r1aae77706aab7d89b4fe19be468fc3c73e9cc84ff79cc2c3bd07c05a@%3Ccommits.camel.apache.org%3E7. https://lists.apache.org/thread.html/r4bdea189c9991aae7a929d28f575ec46e49ed3d68fa5235825f38a4f@%3Cnotifications.netbeans.apache.org%3E8. https://lists.apache.org/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e@%3Ccommits.camel.apache.org%3E9. https://lists.apache.org/thread.html/r7f6d019839df17646ffd0046a99146cacf40492a6c92078f65fd32e0@%3Ccommits.camel.apache.org%3E10. https://lists.apache.org/thread.html/rb89f92aba44f524d5c270e0c44ca7aec4704691c37fe106cf73ec977@%3Cnotifications.netbeans.apache.org%3E11. https://lists.apache.org/thread.html/rfe363bf3a46d440ad57fd05c0e313025c7218364bbdc5fd8622ea7ae@%3Ccommits.camel.apache.org%3E12. https://lists.fedoraproject.org/archives/list/[email protected]/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC13. https://security.netapp.com/advisory/ntap-20200619-000514. https://www.debian.org/security/2022/dsa-5196

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.