Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg4Y2MtZzgzNS03NnJw

Improper Restriction of XML External Entity Reference

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.

Permalink: https://github.com/advisories/GHSA-88cc-g835-76rp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg4Y2MtZzgzNS03NnJw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: about 1 year ago


CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

Identifiers: GHSA-88cc-g835-76rp, CVE-2020-13692
References: Repository: https://github.com/pgjdbc/pgjdbc

Affected Packages

maven:org.postgresql:postgresql
Dependent packages: 3,652
Dependent repositories: 176,054
Downloads:
Affected Version Ranges: < 42.2.13
Fixed in: 42.2.13
All affected versions: 9.4.1207, 9.4.1208, 9.4.1209, 9.4.1210, 9.4.1211, 9.4.1212, 42.0.0, 42.1.0, 42.1.1, 42.1.2, 42.1.3, 42.1.4, 42.2.0, 42.2.1, 42.2.2, 42.2.3, 42.2.4, 42.2.5, 42.2.6, 42.2.7, 42.2.8, 42.2.9, 42.2.10, 42.2.11, 42.2.12
All unaffected versions: 42.2.13, 42.2.14, 42.2.15, 42.2.16, 42.2.17, 42.2.18, 42.2.19, 42.2.20, 42.2.21, 42.2.22, 42.2.23, 42.2.24, 42.2.25, 42.2.26, 42.2.27, 42.2.28, 42.2.29, 42.3.0, 42.3.1, 42.3.2, 42.3.3, 42.3.4, 42.3.5, 42.3.6, 42.3.7, 42.3.8, 42.3.9, 42.3.10, 42.4.0, 42.4.1, 42.4.2, 42.4.3, 42.4.4, 42.4.5, 42.5.0, 42.5.1, 42.5.2, 42.5.3, 42.5.4, 42.5.5, 42.5.6, 42.6.0, 42.6.1, 42.6.2, 42.7.0, 42.7.1, 42.7.2