PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Priority MEDIUM 41CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · High
- Fix status
- Partial Red Hat: 22 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Why it matters now
EPSS 0.04094 90th percentileScored 2026-11-07
Fix Partial org.postgresql:postgresql (Maven): 42.2.13Red Hat: 12 advisoriesRed Hat: 22 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.postgresql:postgresql (Maven) | 9.4.1212.jre6 to before 42.2.13 | 42.2.13 | Patch available | GHSA-88cc-g835-76rp |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.postgresql:postgresql (Maven) Vendor— Affected 9.4.1212.jre6 to before 42.2.13 Fixed in 42.2.13 Patch available GHSA-88cc-g835-76rp
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* | before 42.2.13 | Vulnerable | PostgreSQL |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | up to 1.5.2 | Vulnerable | quarkusio |
| cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions before 42.2.13 Vulnerable ·PostgreSQL
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.5.2 Vulnerable ·quarkusio
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-88cc-g835-76rp org.postgresql:postgresql (Maven) Fixed in 42.2.13 Advisory →
Red Hat 12 advisories
- RHSA-2021:0110 Released 2021-01-13 · Red Hat rating ImportantRed Hat Integration Tech-Preview 2 Camel K security update
- Red Hat Integration - Camel K - Tech-Preview 2
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
- RHSA-2020:3678 Released 2020-09-08 · Red Hat rating ImportantRed Hat Process Automation Manager 7.8.1 Security Update
- Red Hat Process Automation 7
Show 9 more Red Hat advisories
- RHSA-2020:3675 Released 2020-09-08 · Red Hat rating ImportantRed Hat Decision Manager 7.8.1 Security Update
- Red Hat Decision Manager 7
- RHSA-2020:3285 Released 2020-08-03 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux Client (v. 7) postgresql-jdbc-9.2.1002-8.el7_8
- Red Hat Enterprise Linux Client Optional (v. 7) postgresql-jdbc-javadoc-9.2.1002-8.el7_8
- Red Hat Enterprise Linux ComputeNode (v. 7) postgresql-jdbc-9.2.1002-8.el7_8
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) postgresql-jdbc-javadoc-9.2.1002-8.el7_8
- Red Hat Enterprise Linux Server (v. 7) postgresql-jdbc-9.2.1002-8.el7_8
- Red Hat Enterprise Linux Server Optional (v. 7) postgresql-jdbc-javadoc-9.2.1002-8.el7_8
- Red Hat Enterprise Linux Workstation (v. 7) postgresql-jdbc-9.2.1002-8.el7_8
- Red Hat Enterprise Linux Workstation Optional (v. 7) postgresql-jdbc-javadoc-9.2.1002-8.el7_8
- RHSA-2020:3284 Released 2020-08-03 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux Desktop (v. 6) postgresql-jdbc-8.4.704-4.el6_10
- Red Hat Enterprise Linux HPC Node (v. 6) postgresql-jdbc-8.4.704-4.el6_10
- Red Hat Enterprise Linux Server (v. 6) postgresql-jdbc-8.4.704-4.el6_10
- Red Hat Enterprise Linux Workstation (v. 6) postgresql-jdbc-8.4.704-4.el6_10
- RHSA-2020:3286 Released 2020-08-03 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) postgresql-jdbc-42.2.3-3.el8_1, postgresql-jdbc-javadoc-42.2.3-3.el8_1
- RHSA-2020:3283 Released 2020-08-03 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) postgresql-jdbc-42.2.3-3.el8_0, postgresql-jdbc-javadoc-42.2.3-3.el8_0
- RHSA-2020:3248 Released 2020-07-30 · Red Hat rating ImportantRed Hat build of Quarkus 1.3.4 SP1 release and security update
- Red Hat build of Quarkus 1.3.4 SP1
- RHSA-2020:3209 Released 2020-07-29 · Red Hat rating ModerateAMQ Online 1.5.2 release and security update
- Red Hat AMQ Online 1.5.2 GA
- RHSA-2020:3176 Released 2020-07-28 · Red Hat rating Importantpostgresql-jdbc security update
- Red Hat Enterprise Linux AppStream (v. 8) postgresql-jdbc-42.2.3-3.el8_2, postgresql-jdbc-javadoc-42.2.3-3.el8_2
- RHSA-2020:3005 Released 2020-07-20 · Red Hat rating ImportantRed Hat Integration Debezium 1.1.3 security update
- Red Hat Integration Debezium 1.1.3
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat AMQ Online 1.5.2 GA | Fixed | RHSA-2020:3209 |
| Red Hat Decision Manager 7 | Fixed | RHSA-2020:3675 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:3176 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.0) | Fixed | RHSA-2020:3283 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2020:3286 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2020:3284 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2020:3284 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2020:3284 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2020:3284 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:3285 |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
| Red Hat Integration - Camel K - Tech-Preview 2 | Fixed | RHSA-2021:0110 |
| Red Hat Integration Debezium 1.1.3 | Fixed | RHSA-2020:3005 |
| Red Hat Process Automation 7 | Fixed | RHSA-2020:3678 |
| Red Hat build of Quarkus 1.3.4 SP1 | Fixed | RHSA-2020:3248 |
Not affected: 3 products
- Red Hat Fuse 7
- Red Hat Integration Camel K 1
- Red Hat JBoss Fuse 6
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13692
- 2026-10-03 Alias added: GHSA-88cc-g835-76rp
References
Advisory 5
Other 20
- [camel-commits] 20200723 [GitHub] [camel] mmelko opened a new pull request #4038: Update pgjdbc driver verion, that includes fix for CVE-2020-13692
- [camel-commits] 20200723 [GitHub] [camel] mmelko opened a new pull request #4037: Update pgjdbc driver verion, that includes fix for CVE-2020-13692
- [camel-commits] 20200723 [GitHub] [camel] oscerd merged pull request #4038: Update pgjdbc driver version, that includes fix for CVE-2020-13692
- [camel-commits] 20200723 [GitHub] [camel] oscerd merged pull request #4037: Update pgjdbc driver version, that includes fix for CVE-2020-13692
- [camel-commits] 20200723 [camel] branch master updated: Update pgjdbc driver version, that includes fix for CVE-2020-13692 (#4037)
- [camel-commits] 20200723 [camel] branch camel-3.4.x updated: Update pgjdbc driver version, that includes fix for CVE-2020-13692 (#4038)
- [camel-commits] 20200723 [GitHub] [camel] oscerd commented on pull request #4038: Update pgjdbc driver version, that includes fix for CVE-2020-13692
- [netbeans-notifications] 20200731 [GitHub] [netbeans] pepness opened a new pull request #2284: [NETBEANS-4664] - Upgrade JDBC PostgreSQL from 42.2.10 to 42.2.14
- [netbeans-notifications] 20200803 [GitHub] [netbeans] neilcsmith-net commented on pull request #2284: [NETBEANS-4664] - Upgrade JDBC PostgreSQL from 42.2.10 to 42.2.14
- https://lists.apache.org/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r1aae77706aab7d89b4fe19be468fc3c73e9cc84ff79cc2c3bd07c05a@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r4bdea189c9991aae7a929d28f575ec46e49ed3d68fa5235825f38a4f@%3Cnotifications.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/r7f6d019839df17646ffd0046a99146cacf40492a6c92078f65fd32e0@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/rb89f92aba44f524d5c270e0c44ca7aec4704691c37fe106cf73ec977@%3Cnotifications.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/rfe363bf3a46d440ad57fd05c0e313025c7218364bbdc5fd8622ea7ae@%3Ccommits.camel.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC
- https://security.netapp.com/advisory/ntap-20200619-0005
Sources
- CVE-2020-13692 · CVE Program
- CVE-2020-13692 · NVD
- FIRST EPSS
- GHSA-88cc-g835-76rp · GitHub Advisory Database · CC BY 4.0
- CVE-2020-13692 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences