CVE-2020-13692: PostgreSQL JDBC Driver - Improper Restriction of XML External Entity Reference
Summary
CVE-2020-13692: Improper Restriction of XML External Entity Reference. Affects org.postgresql:postgresql versions >= 9.4.1212.jre6, < 42.2.13. Fixed in 42.2.13. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:11
The same CVE-2020-13692 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PostgreSQL JDBC Driver (aka PgJDBC) is a Java library that provides connectivity to PostgreSQL databases. It allows Java applications to interact with PostgreSQL databases by providing a set of classes and methods for database operations. This vulnerability, identified as CVE-2020-13692, affects the PostgreSQL JDBC Driver before version 42.2.13.
Vulnerability Detail
The vulnerability in the PostgreSQL JDBC Driver (PgJDBC) is due to improper restriction of XML external entity references (XXE). This means that an attacker can exploit this vulnerability by providing a specially crafted XML input, which can lead to the disclosure of confidential information, denial of service, or server-side request forgery. The vulnerability has a CVSS score of 7.7, indicating a high severity level.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
42.2.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the PostgreSQL JDBC Driver to the fixed version as soon as possible.
Conclusion
In conclusion, the PostgreSQL JDBC Driver (PgJDBC) before version 42.2.13 is vulnerable to an XXE vulnerability. To mitigate this issue, it is crucial to update the driver to the fixed version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
The PostgreSQL JDBC Driver (PgJDBC) is a Java library that enables Java applications to connect to and interact with PostgreSQL databases.
An XXE vulnerability occurs when an application processes XML input without properly validating or sanitizing it, allowing an attacker to reference external entities and potentially disclose sensitive information or perform other malicious actions.
Exploiting this vulnerability can lead to the disclosure of confidential information, denial of service, or server-side request forgery, depending on the attacker's intentions and the specific context of the application.
To update the PostgreSQL JDBC Driver, you need to modify the Maven dependency in your project's pom.xml file. Change the version to 42.2.13 or later and rebuild your project to include the updated driver.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
