CVE-2020-13692: PostgreSQL JDBC Driver XXE Vulnerability
Summary
CVE-2020-13692: PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. Affects postgresql-jdbc-driver versions < 42.2.13. Fixed in 42.2.13. How to fix ↓
Also tracked for
- org.postgresql:postgresql · Maven
- libpgjava · Debian:11
The same CVE-2020-13692 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver (aka PgJDBC) is a Java library that allows Java programs to connect to a PostgreSQL database. It provides an implementation of the JDBC (Java Database Connectivity) API, enabling developers to interact with PostgreSQL databases using Java code. The driver is widely used in various applications and frameworks that require database connectivity with PostgreSQL.
Vulnerability Detail
The PostgreSQL JDBC Driver before version 42.2.13 is vulnerable to an XML External Entity (XXE) attack. This vulnerability allows an attacker to exploit the XML parsing functionality of the driver to read arbitrary files from the server or cause a denial of service by initiating resource-intensive XML entity expansion. By sending specially crafted XML data, an attacker can trigger the XXE vulnerability and potentially gain unauthorized access to sensitive information or disrupt the availability of the database server.
How To Fix
Minimum fixed version
42.2.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable XML parsing in the PostgreSQL JDBC Driver. This can be achieved by setting the 'xml' connection property to 'false' in the JDBC connection URL. However, this workaround may impact the functionality of your application if it relies on XML-related features provided by the driver.
Conclusion
The PostgreSQL JDBC Driver is vulnerable to an XXE attack, which can lead to unauthorized access to sensitive information or denial of service. It is crucial to upgrade to version 42.2.13 or later to mitigate this vulnerability. If immediate upgrade is not possible, disabling XML parsing in the driver can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql-jdbc-driver →
FAQ
This vulnerability allows an attacker to read arbitrary files from the server or cause a denial of service by exploiting the XML parsing functionality of the PostgreSQL JDBC Driver.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert Playground allows you to analyze your manifest file (e.g., package-lock.json) and provides real-time alerts for open-source vulnerabilities, including CVE-2020-13692.
At the time of this report, there is no known public exploit available for this vulnerability. However, it is crucial to apply the recommended fix or workaround to mitigate the risk.
Yes, you can mitigate this vulnerability by disabling XML parsing in the PostgreSQL JDBC Driver. However, this may impact the functionality of your application if it relies on XML-related features provided by the driver.
You can find more information about this vulnerability in the PostgreSQL JDBC Driver vulnerability database: https://github.com/bitnami/vulndb/tree/main/data/postgresql-jdbc-driver/BIT-postgresql-jdbc-driver-2020-13692.json
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-jdbc-driver.
