CVE-2020-25694: Use of a Broken or Risky Cryptographic Algorithm in PostgreSQL
Summary
GHSA-vmm8-82m2-pcp5: Use of a Broken or Risky Cryptographic Algorithm in PostgreSQL. Affects org.postgresql:postgresql versions < 13.1. Fixed in 13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards. It is widely used in various applications and industries. This vulnerability affects PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24.
Vulnerability Detail
The vulnerability arises when a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters. This creates an opportunity for a man-in-the-middle attack or the ability to observe clear-text transmissions. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
13.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not feasible, a workaround is to ensure that all security-relevant parameters are properly set and not dropped when creating additional database connections. This can be achieved by carefully reviewing the connection parameters and ensuring that no critical security settings are omitted.
Conclusion
In conclusion, this vulnerability in PostgreSQL can lead to a man-in-the-middle attack or clear-text transmission observation, posing risks to data confidentiality, integrity, and system availability. It is crucial to upgrade to the latest version or apply the necessary patches to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards.
This vulnerability affects versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24.
The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.
To fix this vulnerability, it is recommended to upgrade to PostgreSQL version 13.1 or apply the necessary patches for affected versions.
Yes, a workaround is to ensure that all security-relevant parameters are properly set and not dropped when creating additional database connections.
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
