CVE-2020-13692 json
Improper Restriction of XML External Entity Reference
published 2020-06-04 6 y ago modified 2026-09-10 1 mo ago also BIT-postgresql-jdbc-driver-2020-13692 , EUVD-2022-0911 , GHSA-88cc-g835-76rp
- cvss
- 7.7
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.1%
- EPSS 4.1% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Patch / fix
- maven org.postgresql:postgresql 42.2.13
- bitnami postgresql-jdbc-driver 42.2.13
- postgresql postgresql_jdbc_driver 42.2.13
- libpgjava Debian 14, Debian 13, Debian 12 42.2.12-2
debian advisories DEBIAN-CVE-2020-13692
- libpgjava Ubuntu Pro 18.04 LTS 9.4.1212-1ubuntu0.1~esm1
- libpgjava Ubuntu Pro 20.04 LTS 42.2.10-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2020-13692
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- postgresql-jdbc RHEL 7 9.2.1002-8.el7_8
- postgresql-jdbc-javadoc RHEL 7 9.2.1002-8.el7_8
- postgresql-jdbc RHEL 8 42.2.3-3.el8_2
- postgresql-jdbc-javadoc RHEL 8 42.2.3-3.el8_2
- postgresql-jdbc RHEL 6 8.4.704-4.el6_10
- postgresql-jdbc RHEL 8.1 EUS 42.2.3-3.el8_1
- postgresql-jdbc-javadoc RHEL 8.1 EUS 42.2.3-3.el8_1
- postgresql-jdbc RHEL 8.0 E4S 42.2.3-3.el8_0
red hat advisories RHSA-2020:3285RHSA-2020:3176RHSA-2020:3284RHSA-2020:3286RHSA-2020:3283
- postgresql-jdbc SLES for SAP 12 SP5, SLES 12 SP5 9.4-3.3.1
- spacecmd Manager Server Module 4.1 4.1.9-4.12.5
- mgr-libmod Manager Server Module 4.1 4.1.5-3.8.2
- susemanager Manager Server Module 4.1 4.1.22-3.14.6
- yomi-formula Manager Server Module 4.1 0.0.1+git.1604593202.a2c22bf-3.6.5
- spacewalk-web Manager Server Module 4.1 4.1.21-3.12.5
- spacewalk-java Manager Server Module 4.1 4.1.24-3.19.6
- postgresql-jdbc Manager Server Module 4.1 42.2.10-3.3.5
suse advisories SUSE-SU-2021:0599-1SUSE-SU-2020:3781-1SUSE-SU-2020:3466-1
- postgresql-jdbc AlmaLinux 8 42.2.3-3.el8_2
- postgresql-jdbc-javadoc AlmaLinux 8 42.2.3-3.el8_2
almalinux advisories ALSA-2020:3176
- postgresql-jdbc Rocky Linux 8 42.2.3-3.el8_2
rocky linux advisories RLSA-2020:3176
- java-postgresql-jdbc Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 42.2.25-r0
alpine advisories ALPINE-CVE-2020-13692
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-13692 updated cvss 7.7
postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML
-
Red Hat Integration Camel K 1 jdbc-postgresql jdbc-postgresqlaffected: no fix available
-
Red Hat AMQ Online 1.5.2 GAfixed: vendor fix RHSA-2020:3209
-
Red Hat build of Quarkus 1.3.4 SP1fixed: vendor fix RHSA-2020:3248
-
Red Hat Decision Manager 7fixed: vendor fix RHSA-2020:3675
-
Red Hat Enterprise Linux AppStream (v. 8) postgresql-jdbc 42.2.3-3.el8_2, postgresql-jdbc-javadoc 42.2.3-3.el8_2fixed: vendor fix RHSA-2020:3176
-
Red Hat Enterprise Linux AppStream E4S (v. 8.0) postgresql-jdbc 42.2.3-3.el8_0, postgresql-jdbc-javadoc 42.2.3-3.el8_0fixed: vendor fix RHSA-2020:3283
-
Red Hat Enterprise Linux AppStream EUS (v. 8.1) postgresql-jdbc 42.2.3-3.el8_1, postgresql-jdbc-javadoc 42.2.3-3.el8_1fixed: vendor fix RHSA-2020:3286
-
Red Hat Enterprise Linux Client (v. 7) postgresql-jdbc 9.2.1002-8.el7_8 Red Hat Enterprise Linux Client Optional (v. 7) postgresql-jdbc-javadoc 9.2.1002-8.el7_8 Red Hat Enterprise Linux ComputeNode (v. 7) postgresql-jdbc 9.2.1002-8.el7_8 Red Hat Enterprise Linux ComputeNode Optional (v. 7) postgresql-jdbc-javadoc 9.2.1002-8.el7_8fixed: vendor fix RHSA-2020:3285
show 9 moreshow fewer
-
Red Hat Enterprise Linux Desktop (v. 6) postgresql-jdbc 8.4.704-4.el6_10 Red Hat Enterprise Linux HPC Node (v. 6) postgresql-jdbc 8.4.704-4.el6_10 Red Hat Enterprise Linux Server (v. 6) postgresql-jdbc 8.4.704-4.el6_10fixed: vendor fix RHSA-2020:3284
-
Red Hat Enterprise Linux Server (v. 7) postgresql-jdbc 9.2.1002-8.el7_8 Red Hat Enterprise Linux Server Optional (v. 7) postgresql-jdbc-javadoc 9.2.1002-8.el7_8fixed: vendor fix RHSA-2020:3285
-
Red Hat Enterprise Linux Workstation (v. 6) postgresql-jdbc 8.4.704-4.el6_10fixed: vendor fix RHSA-2020:3284
-
Red Hat Enterprise Linux Workstation (v. 7) postgresql-jdbc 9.2.1002-8.el7_8 Red Hat Enterprise Linux Workstation Optional (v. 7) postgresql-jdbc-javadoc 9.2.1002-8.el7_8fixed: vendor fix RHSA-2020:3285
-
Red Hat Fuse 7.8.0fixed: vendor fix RHSA-2020:5568
-
Red Hat Integration - Camel K - Tech-Preview 2fixed: vendor fix RHSA-2021:0110
-
Red Hat Integration Debezium 1.1.3fixed: vendor fix RHSA-2020:3005
-
Red Hat Process Automation 7fixed: vendor fix RHSA-2020:3678
-
Red Hat Fuse 7 quarkus-jdbc-postgresql, quarkus-jdbc-postgresql-deployment Red Hat Integration Camel K 1 quarkus-jdbc-postgresql, quarkus-jdbc-postgresql-deployment Red Hat JBoss Fuse 6 jdbc-postgresql jdbc-postgresqlnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
4.09% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H |
| NVD | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.postgresql:postgresql | >=9.4.1212.jre6, <42.2.13 |
42.2.13 |
| bitnami | postgresql-jdbc-driver | <42.2.13 |
42.2.13 |
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb65
web, patch, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC/
vendor-advisory, web
-
debian.org
/security/2022/dsa-5196
vendor-advisory, web, third-party-advisory, advisory
-
jdbc.postgresql.org
/documentation/changelog.html#version_42.2.13
web, release-notes, vendor-advisory, advisory
-
security.netapp.com
/advisory/ntap-20200619-0005/
third-party-advisory, advisory
-
lists.apache.org
/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r7f6d019839df17646ffd0046a99146cacf40492a6c92078f65fd32e0%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r1aae77706aab7d89b4fe19be468fc3c73e9cc84ff79cc2c3bd07c05a%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/rfe363bf3a46d440ad57fd05c0e313025c7218364bbdc5fd8622ea7ae%40%3Ccommits.camel.apache.org%3E
mailing-list, web
-
lists.apache.org
/thread.html/r4bdea189c9991aae7a929d28f575ec46e49ed3d68fa5235825f38a4f%40%3Cnotifications.netbeans.apache.org%
mailing-list, web
-
lists.apache.org
/thread.html/rb89f92aba44f524d5c270e0c44ca7aec4704691c37fe106cf73ec977%40%3Cnotifications.netbeans.apache.org%
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2020-13692
advisory, web
-
lists.apache.org
/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/r1aae77706aab7d89b4fe19be468fc3c73e9cc84ff79cc2c3bd07c05a@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/r4bdea189c9991aae7a929d28f575ec46e49ed3d68fa5235825f38a4f@%3Cnotifications.netbeans.apache.org%3E
web
-
lists.apache.org
/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/r7f6d019839df17646ffd0046a99146cacf40492a6c92078f65fd32e0@%3Ccommits.camel.apache.org%3E
web
-
lists.apache.org
/thread.html/rb89f92aba44f524d5c270e0c44ca7aec4704691c37fe106cf73ec977@%3Cnotifications.netbeans.apache.org%3E
web
-
lists.apache.org
/thread.html/rfe363bf3a46d440ad57fd05c0e313025c7218364bbdc5fd8622ea7ae@%3Ccommits.camel.apache.org%3E
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC
web
-
security.netapp.com
/advisory/ntap-20200619-0005
web
Sources
- CVE List CVE-2020-13692
- GitHub Advisory GHSA-88cc-g835-76rp
- NVD CVE-2020-13692
- OSV BIT-postgresql-jdbc-driver-2020-13692
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.