{"id":"CVE-2020-13692","aliases":["ALPINE-CVE-2020-13692","ALSA-2020:3176","BIT-postgresql-jdbc-driver-2020-13692","DEBIAN-CVE-2020-13692","EUVD-2022-0911","GHSA-88cc-g835-76rp","MGASA-2020-0319","RHSA-2020:3176","RHSA-2020:3283","RHSA-2020:3284","RHSA-2020:3285","RHSA-2020:3286","RLSA-2020:3176","SUSE-SU-2020:3466-1","SUSE-SU-2020:3781-1","SUSE-SU-2021:0599-1","UBUNTU-CVE-2020-13692","USN-5238-1"],"status":"published","title":"Improper Restriction of XML External Entity Reference","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04094,"percentile":0.90814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2020-06-04T15:07:37Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Maven","package":"org.postgresql:postgresql","fixed_in":["42.2.13"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"java-postgresql-jdbc","fixed_in":["42.2.25-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"postgresql-jdbc","fixed_in":["42.2.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"postgresql-jdbc-javadoc","fixed_in":["42.2.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"postgresql-jdbc-driver","fixed_in":["42.2.13"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libpgjava","fixed_in":["42.2.12-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libpgjava","fixed_in":["42.2.12-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libpgjava","fixed_in":["42.2.12-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"postgresql-jdbc","fixed_in":["42.2.5-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-jdbc","fixed_in":["0:8.4.704-4.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-jdbc","fixed_in":["0:8.4.704-4.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-jdbc","fixed_in":["0:8.4.704-4.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-jdbc","fixed_in":["0:8.4.704-4.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"postgresql-jdbc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"postgresql-jdbc-javadoc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"postgresql-jdbc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"postgresql-jdbc-javadoc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"postgresql-jdbc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"postgresql-jdbc-javadoc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"postgresql-jdbc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"postgresql-jdbc-javadoc","fixed_in":["0:9.2.1002-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"postgresql-jdbc","fixed_in":["0:42.2.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"postgresql-jdbc-javadoc","fixed_in":["0:42.2.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"postgresql-jdbc","fixed_in":["0:42.2.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"image-sync-formula","fixed_in":["0.1.1605087464.65d1b51-3.9.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-libmod","fixed_in":["4.1.5-3.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"postgresql-jdbc","fixed_in":["42.2.10-3.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"python-susemanager-retail","fixed_in":["1.0.1605087464.65d1b51-3.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"saltboot-formula","fixed_in":["0.1.1605087464.65d1b51-3.9.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacecmd","fixed_in":["4.1.9-4.12.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","fixed_in":["4.1.8-3.9.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","fixed_in":["4.1.18-4.14.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-certs-tools","fixed_in":["4.1.14-3.9.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-client-tools","fixed_in":["4.1.8-4.9.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","fixed_in":["4.1.24-3.19.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-search","fixed_in":["4.1.4-3.6.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-setup","fixed_in":["4.1.7-3.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","fixed_in":["4.1.21-3.12.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"supportutils-plugin-susemanager","fixed_in":["4.1.4-3.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","fixed_in":["4.1.22-3.14.6"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","fixed_in":["4.1-11.20.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","fixed_in":["4.1-11.20.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-frontend-libs","fixed_in":["4.1.1-3.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","fixed_in":["4.1.17-3.16.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","fixed_in":["4.1.18-3.16.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sync-data","fixed_in":["4.1.8-3.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"uyuni-cluster-provider-caasp","fixed_in":["4.1.3-3.3.5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"yomi-formula","fixed_in":["0.0.1+git.1604593202.a2c22bf-3.6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"postgresql-jdbc","fixed_in":["9.4-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"postgresql-jdbc","fixed_in":["9.4-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpgjava","fixed_in":["9.4.1212-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpgjava","fixed_in":["42.2.10-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.1212.jre6"},{"fixed":"42.2.13"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"java-postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.25-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"postgresql-jdbc-driver","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"42.2.13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.12-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.12-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.12-2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.postgresql:postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.1212.jre6"},{"fixed":"42.2.13"}]}],"versions":["42.0.0","42.0.0.jre6","42.0.0.jre7","42.1.0","42.1.0.jre7","42.1.1","42.1.1.jre6","42.1.1.jre7","42.1.2","42.1.2.jre6","42.1.2.jre7","42.1.3","42.1.3.jre6","42.1.3.jre7","42.1.4","42.1.4.jre6","42.1.4.jre7","42.2.0","42.2.0.jre6","42.2.0.jre7","42.2.1","42.2.1.jre6","42.2.1.jre7","42.2.10","42.2.10.jre6","42.2.10.jre7","42.2.11","42.2.11.jre6","42.2.11.jre7","42.2.12","42.2.12.jre6","42.2.12.jre7","42.2.2","42.2.2.jre6","42.2.2.jre7","42.2.3","42.2.3.jre6","42.2.3.jre7","42.2.4","42.2.4.jre6","42.2.4.jre7","42.2.5","42.2.5.jre6","42.2.5.jre7","42.2.6","42.2.6.jre6","42.2.6.jre7","42.2.7","42.2.7.jre6","42.2.7.jre7","42.2.8","42.2.8.jre6","42.2.8.jre7","42.2.9","42.2.9.jre6","42.2.9.jre7","9.4.1212.jre6","9.4.1212.jre7"]},{"source":"osv","ecosystem":"Mageia:7","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.5-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.704-4.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.704-4.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.704-4.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.704-4.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.1002-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"postgresql-jdbc-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.2.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"bind-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1603299886.60e4bcf-3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.2-4.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.10-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.5-3.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.3-4.16.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-4.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.35-3.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.40-3.48.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.25-3.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.32-3.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.23-3.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.31-3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1605087464.65d1b51-3.9.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"mgr-libmod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5-3.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.10-3.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1605087464.65d1b51-3.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1605087464.65d1b51-3.9.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-4.12.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-3.9.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.18-4.14.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.14-3.9.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-4.9.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.24-3.19.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3.6.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-3.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.12.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.4-3.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.22-3.14.6"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.20.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.20.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-frontend-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-3.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.17-3.16.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.18-3.16.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-3.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"uyuni-cluster-provider-caasp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-3.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"yomi-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1+git.1604593202.a2c22bf-3.6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"postgresql-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.1212-1ubuntu0.1~esm1"}]}],"versions":["9.4.1212-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.10-1ubuntu0.1~esm1"}]}],"versions":["42.2.6-1","42.2.8-1","42.2.9-1","42.2.10-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.1212-1ubuntu0.1~esm1"}]}],"versions":["9.4.1212-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libpgjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.2.10-1ubuntu0.1~esm1"}]}],"versions":["42.2.6-1","42.2.8-1","42.2.9-1","42.2.10-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"postgresql","product":"postgresql_jdbc_driver"},{"vendor":"quarkus","product":"quarkus"}],"references":[{"url":"https://github.com/pgjdbc/pgjdbc/commit/14b62aca4764d496813f55a43d050b017e01eb65","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.13","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200619-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7f6d019839df17646ffd0046a99146cacf40492a6c92078f65fd32e0%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1aae77706aab7d89b4fe19be468fc3c73e9cc84ff79cc2c3bd07c05a%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfe363bf3a46d440ad57fd05c0e313025c7218364bbdc5fd8622ea7ae%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4bdea189c9991aae7a929d28f575ec46e49ed3d68fa5235825f38a4f%40%3Cnotifications.netbeans.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb89f92aba44f524d5c270e0c44ca7aec4704691c37fe106cf73ec977%40%3Cnotifications.netbeans.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2022/dsa-5196","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13692","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r00bcc6b2da972e0d6332a4ebc7807e17305d8b8e7fb2ae63d2a3cbfb@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r01ae1b3d981cf2e563e9b5b0a6ea54fb3cac8e9a0512ee5269e3420e@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r0478a1aa9ae0dbd79d8f7b38d0d93fa933ac232e2b430b6f31a103c0@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1aae77706aab7d89b4fe19be468fc3c73e9cc84ff79cc2c3bd07c05a@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4bdea189c9991aae7a929d28f575ec46e49ed3d68fa5235825f38a4f@%3Cnotifications.netbeans.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r631f967db6260d6178740a3314a35d9421facd8212e62320275fa78e@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7f6d019839df17646ffd0046a99146cacf40492a6c92078f65fd32e0@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb89f92aba44f524d5c270e0c44ca7aec4704691c37fe106cf73ec977@%3Cnotifications.netbeans.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfe363bf3a46d440ad57fd05c0e313025c7218364bbdc5fd8622ea7ae@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCCAPM6FSNOC272DLSNQ6YHXS3OMHGJC","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20200619-0005","tags":["web"]},{"url":"https://github.com/advisories/GHSA-88cc-g835-76rp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13692","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-3176.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-13692","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13692","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0319.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27017","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3176","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/articles/5266441","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1852985","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3176.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13692","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3283","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3283.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3284","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3284.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3285","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3285.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3286","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3286.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:3176","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203466-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144447","tags":["report"]},{"url":"https://bugzilla.suse.com/1172079","tags":["report"]},{"url":"https://bugzilla.suse.com/1173199","tags":["report"]},{"url":"https://bugzilla.suse.com/1175739","tags":["report"]},{"url":"https://bugzilla.suse.com/1175876","tags":["report"]},{"url":"https://bugzilla.suse.com/1175987","tags":["report"]},{"url":"https://bugzilla.suse.com/1176074","tags":["report"]},{"url":"https://bugzilla.suse.com/1176172","tags":["report"]},{"url":"https://bugzilla.suse.com/1177336","tags":["report"]},{"url":"https://bugzilla.suse.com/1177435","tags":["report"]},{"url":"https://bugzilla.suse.com/1177790","tags":["report"]},{"url":"https://bugzilla.suse.com/1178060","tags":["report"]},{"url":"https://bugzilla.suse.com/1178145","tags":["report"]},{"url":"https://bugzilla.suse.com/1178195","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13692","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203781-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172287","tags":["report"]},{"url":"https://bugzilla.suse.com/1175607","tags":["report"]},{"url":"https://bugzilla.suse.com/1176417","tags":["report"]},{"url":"https://bugzilla.suse.com/1176898","tags":["report"]},{"url":"https://bugzilla.suse.com/1177184","tags":["report"]},{"url":"https://bugzilla.suse.com/1177704","tags":["report"]},{"url":"https://bugzilla.suse.com/1177706","tags":["report"]},{"url":"https://bugzilla.suse.com/1177767","tags":["report"]},{"url":"https://bugzilla.suse.com/1177975","tags":["report"]},{"url":"https://bugzilla.suse.com/1178303","tags":["report"]},{"url":"https://bugzilla.suse.com/1178503","tags":["report"]},{"url":"https://bugzilla.suse.com/1178704","tags":["report"]},{"url":"https://bugzilla.suse.com/1178839","tags":["report"]},{"url":"https://bugzilla.suse.com/1179257","tags":["report"]},{"url":"https://bugzilla.suse.com/1179759","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210599-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13692","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5238-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-13692","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2020-06-04T15:07:37Z","modified":"2024-08-04T12:25:16.487Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2022-0911","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2020-06-04T15:07:37Z","modified":"2024-08-04T12:25:16Z","updated_at":"2026-11-03T03:07:36.182524Z"}],"ghsa":[{"id":"GHSA-88cc-g835-76rp","title":"Improper Restriction of XML External Entity Reference","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2022-02-10T00:30:07Z","modified":"2024-05-15T06:44:17Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:49.48194Z"}],"nvd":[{"id":"CVE-2020-13692","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2020-06-04T16:15:12.657Z","modified":"2026-06-17T02:53:33.927Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"ALPINE-CVE-2020-13692","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2020-06-04T16:15:12.657Z","modified":"2026-11-03T06:32:23.82855542Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-13692","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2020-06-04T16:15:12.657Z","modified":"2026-10-24T14:06:21.369765894Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13692","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2020-06-04T16:15:12.657Z","modified":"2026-10-26T12:00:36.453653859Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-88cc-g835-76rp","title":"Improper Restriction of XML External Entity Reference","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2022-02-10T00:30:07Z","modified":"2026-09-10T03:49:27.955729174Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"RHSA-2020:3176","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-13T22:06:50Z","modified":"2026-08-05T10:07:31Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3283","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-13T22:06:36Z","modified":"2026-08-05T10:07:32Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3284","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-13T22:06:50Z","modified":"2026-08-05T10:07:33Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3285","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-13T22:06:57Z","modified":"2026-08-05T10:07:33Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3286","title":"Red Hat Security Advisory: postgresql-jdbc security update","status":"published","published":"2024-09-13T22:06:42Z","modified":"2026-08-05T10:07:34Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RLSA-2020:3176","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692)\n\nThis update introduces a backwards incompatible change required to resolve this issue. Refer to the Rocky Enterprise Software Foundation Knowledgebase article 5266441 linked to in the References section for information on how to re-enable the old insecure behavior.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-28T12:19:54Z","modified":"2026-02-04T07:40:22.62948Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-13692","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2020-06-04T16:15:00Z","modified":"2026-02-04T04:23:38.537703Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"ALSA-2020:3176","title":"Important: postgresql-jdbc security update","description":"PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.\n\nSecurity Fix(es):\n\n* postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692)\n\nThis update introduces a backwards incompatible change required to resolve this issue. Refer to the AlmaLinux Knowledgebase article 5266441 linked to in the References section for information on how to re-enable the old insecure behavior.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-07-28T12:19:54Z","modified":"2026-10-29T11:00:13.783036712Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-postgresql-jdbc-driver-2020-13692","description":"PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.","status":"published","published":"2024-03-06T11:02:43.391Z","modified":"2026-09-08T08:48:18.480532636Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"MGASA-2020-0319","title":"Updated postgresql-jdbc packages fix security vulnerability","description":"XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692).\n","status":"published","published":"2020-08-18T17:41:27Z","modified":"2026-04-16T04:42:36.034995246Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"SUSE-SU-2020:3466-1","title":"Security update for SUSE Manager Server 4.0","description":"\nThis update fixes the following issues:\n\nbind-formula:\n\n- Temporarily disable dnssec-validation as hotfix for bsc#1177790\n- Update to version 0.1.1603299886.60e4bcf\n\ngrafana-formula:\n\n- Use variable for product name\n- Add support for system groups in Client Systems dashboard\n\npostgresql-jdbc:\n\n- Address CVE-2020-13692 (bsc#1172079)\n- Add patch:\n- Major changes since 9.4-1200:\n  * License changed to BSD-2-Clause and BSD-3-Clause and Apache-2.0\n  * Support PostgreSQL 9.5, 9.6, 10 11 and 12 added\n  * Support for PostgreSQL versions below 8.2 was dropped\n  * Support for JDK8, JDK9, JDK10, JDK11 and JDK12\n  * Support for JDK 1.4 and 1.5 was dropped\n  * Support for JDBC 4.2 added\n  * Add maxResultBuffer property\n  * Add caller push of binary data\n  * Read only transactions\n  * pkcs12 key functionality\n  * New 'escapeSyntaxCallMode' connection property\n  * Connection property to limit server error detail in exception\n    exceptions\n  * CancelQuery() to PGConnection public interface\n  * Support for large update counts (JDBC 4.2)\n  * Add Binary Support for Oid.NUMERIC and Oid.NUMERIC_ARRAY\n  * Expose parameter status messages (GUC_REPORT) to the user\n  * Log ignoring rollback when no transaction in progress\n  * Map inet type to InetAddress\n  * Change ISGENERATED to ISGENERATEDCOLUMN as per spec\n  * Support temporary replication slots in ReplicationCreateSlotBuilder\n  * Return function (PostgreSQL 11) columns in PgDatabaseMetaData#getFunctionColumns\n  * Return information on create replication slot, now the snapshot_name\n    is exported to allow a consistent snapshot in some uses cases\n  * `ssl=true` implies `sslmode=verify-full`, that is it requires valid\n    server certificate\n  * Support for `sslmode=allow/prefer/require`\n  * Added server hostname verification for non-default SSL factories in\n    `sslmode=verify-full` (CVE-2018-10936)\n  * PreparedStatement.setNull(int parameterIndex, int t, String typeName)\n    no longer ignores the typeName argument if it is not setNull\n  * Reduce the severity of the error log messages when an exception is\n    re-thrown. The error will be thrown to caller to be dealt with so no need\n    to log at this verbosity by pgjdbc\n  * Deprecate Fastpath API PR 903\n  * Support parenthesis in {oj ...} JDBC escape syntax\n  * socksProxyHost is ignored in case it contains empty string\n  * Support SCRAM-SHA-256 for PostgreSQL 10 in the JDBC 4.2 version (Java 8+)\n    using the Ongres SCRAM library\n  * Make SELECT INTO and CREATE TABLE AS return row counts to the client in\n    their command tags\n  * Support Subject Alternative Names for SSL connections\n  * Support isAutoIncrement metadata for PostgreSQL 10 IDENTITY column\n  * Support for primitive arrays PR 887 3e0491a\n  * Implement support for get/setNetworkTimeout() in connections\n  * Make GSS JAAS login optional, add an option 'jaasLogin'\n  * Improve behaviour of ResultSet.getObject(int, Class)\n  * Parse CommandComplete message using a regular expression, allows complete\n    catch of server returned commands for INSERT, UPDATE, DELETE, SELECT,\n    FETCH, MOVE,COPY and future commands.\n  * Use 'time with timezone' and 'timestamp with timezone' as is and ignore the\n    user provided Calendars, 'time' and 'timestamp' work as earlier except\n    '00:00:00' now maps to 1970-01-01 and '24:00:00' uses the system provided\n    Calendar ignoring the user-provided one\n  * Change behaviour of multihost connection. The new behaviour is to try all\n    secondaries first before trying the master\n  * Drop support for the (insecure) crypt authentication method\n  * slave and preferSlave values for the targetServerType connection property\n    have been deprecated in favour of secondary and preferSecondary\n    respectively\n  * Statements with non-zero fetchSize no longer require server-side\n    named handle. This might cause issues when using old PostgreSQL versions\n    (pre-8.4)+fetchSize+interleaved ResultSet processing combo\n  * Better logic for returning keyword detection. Previously, pgjdbc could be\n    defeated by column names that contain returning, so pgjdbc failed to\n    'return generated keys' as it considered statement as already having\n    returning keyword\n  * Use server-prepared statements for batch inserts when prepareThreshold\u003e0.\n    This enables batch to use server-prepared from the first executeBatch()\n    execution (previously it waited for prepareThreshold executeBatch() calls)\n  * Replication protocol API was added: replication API documentation\n  * java.util.logging is now used for logging: logging documentation\n  * Add support for PreparedStatement.setCharacterStream(int, Reader)\n  * Ensure executeBatch() can be used with pgbouncer. Previously pgjdbc could\n    use server-prepared statements for batch execution even with\n    prepareThreshold=0\n  * Error position is displayed when SQL has unterminated literals,\n    comments, etc\n  * Strict handling of accepted values in getBoolean and setObject(BOOLEAN),\n    now it follows PostgreSQL accepted values, only 1 and 0 for numeric types\n    are acepted (previusly !=0 was true)\n  * Deprecated PGPoolingDataSource, instead of this class you should use a\n    fully featured connection pool like HikariCP, vibur-dbcp, commons-dbcp,\n    c3p0, etc\n  * 'current transaction is aborted' exception includes the original exception\n    via caused-by chain\n  * Better support for RETURNGENERATEDKEYS, statements with RETURNING clause\n  * Avoid user-visible prepared-statement errors if client uses\n    DEALLOCATE/DISCARD statements (invalidate cache when those statements\n    detected)\n  * Avoid user-visible prepared-statement errors if client changes searchpath\n    (invalidate cache when set searchpath detected)\n  * Support comments when replacing {fn ...} JDBC syntax\n  * Support for Types.REF_CURSOR\n  * Performance optimization for timestamps (~TimeZone.getDefault optimization)\n  * Ability to customize socket factory (e.g. for unix domain sockets)\n  * Ignore empty sub-queries in composite queries\n  * Add equality support to PSQLState\n  * Improved composite/array type support and type naming changes.\n- Update to version 42.2.10\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.10\n- Update to version 42.2.9\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.9\n- Update to version 42.2.8\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.8\n- Update to version 42.2.7\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.7\n- Update to version 42.2.6\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.6\n- Update to version 42.2.5\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.5\n- Update to version 42.2.4\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.4\n- Update to version 42.2.3\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.3\n- Update to version 42.2.2\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.2\n- Update to version 42.2.1\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.1\n- Update to version 42.2.0\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.2.0\n- Update to version 42.1.4\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.1.4\n- Update to version 42.1.3\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.1.3\n- Update to version 42.1.2\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.1.2\n- Update to version 42.1.1\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.1.1\n- Update to version 42.1.0\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.1.1\n- Update to version 42.2.0\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_42.1.0\n- Update to version 9.4.1211\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1211\n- Update to version 9.4.1210\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1210\n- Update to version 9.4.1209\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1209\n- Update to version 9.4.1208\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1208\n- Update to version 9.4.1207\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1207\n- Update to version 9.4.1206\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1206\n- Update to version 9.4.1205\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1204\n- Update to version 9.4.1204\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1204\n- Update to version 9.4.1203\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1203\n- Update to version 9.4.1202\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1202\n- Update to version 9.4.1201\n  * https://jdbc.postgresql.org/documentation/changelog.html#version_9.4-1201\n\nprometheus-exporters-formula:\n\n- Fix empty directory values initialization\n- Disable reverse proxy on default\n\nprometheus-formula:\n\n- Update to version 0.2.3\n- Disable Alertmanager clustering (bsc#1178145)\n- Update to version 0.2.2\n- Use variable for product name\n\nsalt-netapi-client:\n\n- Version 0.18.0\n  See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.18.0\n\nspacewalk-admin:\n\n- Use the license macro to mark the LICENSE in the package so that\n  when installing without docs, it does install the LICENSE file\n- Prevent javax.net.ssl.SSLHandshakeException after upgrading from\n  SUSE Manager 3.2 (bsc#1177435)\n\nspacewalk-backend:\n\n- ISS: Differentiate packages with same nevra but different checksum in the same channel (bsc#1178195)\n- Fix unique machine_id detection (bsc#1176074)\n\nspacewalk-java:\n\n- Revert: Sync state modules when starting action chain execution (bsc#1177336)\n- Sync state modules when starting action chain execution (bsc#1177336)\n- Fix repo url of AppStream in generated RHEL/Centos 8 kickstart file (bsc#1175739)\n- Log token verify errors and check for expired tokens\n- Execute Salt SSH actions in parallel (bsc#1173199)\n- Take pool and volume from Salt virt.vm_info for files and blocks disks (bsc#1175987)\n- Fix action chain resuming when patches updating salt-minion don't cause service to be\n  restarted (bsc#1144447)\n- Renaming autoinstall distro didn't change the name of the Cobbler distro (bsc#1175876)\n\nspacewalk-web:\n\n- Fix link to documentation in Admin -\u003e Manager Configuration -\u003e Monitoring (bsc#1176172)\n- Don't allow selecting spice for Xen PV and PVH guests\n\nsusemanager:\n\n- Add --force to mgr-create-bootstrap-repo to enforce generation\n  even when some products are not synchronized\n\nsusemanager-schema:\n\n- Execute Salt SSH actions in parallel (bsc#1173199)\n\nsusemanager-sls:\n\n- Revert: Sync state modules when starting action chain execution (bsc#1177336)\n- Sync state modules when starting action chain execution (bsc#1177336)\n- Fix grub2 autoinstall kernel path (bsc#1178060)\n- Move channel token information from sources.list to auth.conf on Debian 10 and Ubuntu 18 and newer\n- Fix action chain resuming when patches updating salt-minion don't cause service to be\n  restarted (bsc#1144447)\n- Make grub2 autoinstall kernel path relative to the boot partition root (bsc#1175876)\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2020-11-20T14:06:24Z","modified":"2026-02-04T02:34:35.672707Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:3781-1","title":"Security update for SUSE Manager Server 4.1","description":"This update fixes the following issues:\n\nimage-sync-formula:\n\n- Send image_synced event to master\n\npostgresql-jdbc:\n\n- Address CVE-2020-13692 (bsc#1172079)\n\npxe-yomi-image-sle15:\n\n- Update config.sh based on last JeOS template\n- Update JEOS_LOCALE to en_US.UTF-8\n- Support config{_url}{_name} for user provided configuration\n\npython-susemanager-retail:\n\n- Handle organizations in retail_create_delta\n\nsaltboot-formula:\n\n- Support older SLE11 cryptsetup (bsc#1172287)\n- Use images with 'synced' flag\n\nspacecmd:\n\n- Fix: make spacecmd build on Debian\n\nspacewalk-admin:\n\n- Use the license macro to mark the LICENSE in the package so that\n  when installing without docs, it does install the LICENSE file\n- Prevent javax.net.ssl.SSLHandshakeException after upgrading from SUSE Manager 3.2 (bsc#1177435)\n\nspacewalk-backend:\n\n- Fix missing `LiteServer.add_suse_products` method (bsc#1178704)\n- Do not raise TypeError when processing SUSE products (bsc#1178704)\n- Fix spacewalk-repo-sync to successfully manage and sync ULN repositories\n- Fix errors in spacewalk-debug and align postgresql queries to new DB version\n- ISS: Differentiate packages with same nevra but different checksum in the same channel (bsc#1178195)\n- Re-enables possibility to use local repos with repo-sync (bsc#1175607)\n- Add `allow_vendor_change` option to rhn clients for dist upgrades\n\nspacewalk-certs-tools:\n\n- Improve check for correct CA trust store directory (bsc#1176417)\n\nspacewalk-client-tools:\n\n- Update translations\n\nspacewalk-java:\n\n- Update content sensitive help links\n- Update exception message in findSyncedMandatoryChannels\n- Report resolved module dependencies on CLM project details page\n- Allow creating custom ULN repositories with uln:// urls\n- Change message 'Minion is down' to be more accurate\n- Localize documentation links\n- Temp: revert Sync state modules when starting action chain execution (bsc#1177336)\n- Fix check for available products on ISS Slaves (bsc#1177184)\n- XMLRPC: Report architecture label in the list of installed packages (bsc#1176898)\n- Get media.1/products for cloned channels (bsc#1178303)\n- Calculate size to truncate a history message based on the htmlified version (bsc#1178503)\n- Make image pillar visible only in buildhost organization\n- Maintain list of synced images in pillar\n- Enable validation of Content Lifecycle Management entities in the XMLRPC API (bsc#1177706)\n- Fix the order of the arguments in the XMLRPC API doc for contentmanagement.buildProject (bsc#1177704)\n- Fix repo url of AppStream in generated RHEL/Centos 8 kickstart file (bsc#1175739)\n- Log token verify errors and check for expired tokens\n- Show only kernel options in advanced autoinstallation page when working with a salt minion (bsc#1177767)\n- Show cluster upgrade plan in the upgrade UI\n- Take pool and volume from Salt virt.vm_info for files and blocks disks (bsc#1175987)\n- Add new allowVendorChange flag for dist upgrades\n- Sync state modules when starting action chain execution (bsc#1177336)\n- Enable redfish power management by default\n\nspacewalk-search:\n\n- Add multi lang support to the document search\n\nspacewalk-setup:\n\n- Add sock_pool_size setting by default for better performance\n\nspacewalk-web:\n\n- Update content sensitive help links\n- Fix mandatory channels JS API to finish loading in case of error (bsc#1178839)\n- Fix the search panel in CLM filters page\n- Localize documentation links\n- Fix link to documentation in Admin -\u003e Manager Configuration -\u003e Monitoring (bsc#1176172)\n- Show cluster upgrade plan in the upgrade UI\n- Don't allow selecting spice for Xen PV and PVH guests\n\nsupportutils-plugin-susemanager:\n\n- Remove checks for obsolete packages\n- Gather new configfiles\n- Add more important informations\n\nsusemanager:\n\n- Adapt Debian10 bootstrap repository definition for salt on Python 3\n- Add --force to mgr-create-bootstrap-repo to enforce generation\n  even when some products are not synchronized\n\nsusemanager-doc-indexes:\n\n- Added warning about local repositories in the Clients Configuration Guide\n- Removed duplicate contact method entry in Client Configuration Guide\n- Enabled upgrade section for SLE clients on Uyuni in Clients Configuration Guide\n- Added a section for working with bootstrap repositories and End of Life products in Client Configuration Guide\n- Added Salt Minion file contact method to Client Configuration Guide\n- Added Redfish to power management protocols section\n- Clarify that port 22 is required for the SUSE Manager server in the installation guide (bsc#1177975)\n- Added procedure for adding virtualization guests to the Client Configuration Guide\n- New guide added: Quickstart SAP Guide\n- Add multilang support\n\nsusemanager-docs_en:\n\n- Added warning about local repositories in the Clients Configuration Guide\n- Removed duplicate contact method entry in Client Configuration Guide\n- Enabled upgrade section for SLE clients on Uyuni in Clients Configuration Guide\n- Added a section for working with bootstrap repositories and End of Life products in Client Configuration Guide\n- Added Salt Minion file contact method to Client Configuration Guide\n- Added Redfish to power management protocols section\n- Clarify that port 22 is required for the SUSE Manager server in the installation guide (bsc#1177975)\n- Added procedure for adding virtualization guests to the Client Configuration Guide\n- New guide added: Quickstart SAP Guide\n- Add multilang support\n\nmgr-libmod:\n\n- Fix `module not found` exception handling. (bsc#1179257)\n\nsusemanager-frontend-libs:\n\n- Update Bootstrap to 3.1.0\n\nsusemanager-schema:\n\n- Move dist upgrade SQL file to the correct directory so it gets picked up in schema upgrades (bsc#1179759)\n- Add `preferred_docs_locale` to UserInfo table\n- Add new column to rhnactiondup table for allowVendorChange flag\n\nsusemanager-sls:\n\n- Fix: sync before start action chains (bsc#1177336)\n- Temp: revert Sync state modules when starting action chain execution (bsc#1177336)\n- Handle group- and org-specific image pillars\n- Use require in reboot trigger (bsc#1177767)\n- Add pillar option to get allowVendorChange option during dist upgrade\n- Sync state modules when starting action chain execution (bsc#1177336)\n\nsusemanager-sync-data:\n\n- Add new channel families for CAASP on ARM64 and HPC15 SP2 LTSS\n- Remove duplicate repo definition\n\nuyuni-cluster-provider-caasp:\n\n- Show the cluster upgrade plan in the UI\n\nyomi-formula:\n\n- Update to version 0.0.1+git.1604593202.a2c22bf:\n  * storage: hide mountpoint if no filesystem\n  * software: migrate repos as certs\n  * software: add verify parameter\n  * _grains: efi grains are in Salt now\n  * software: transfer current repository\n  * software: add repository options\n  * lvm: fix indentation\n  * partitioned: fix parted call and tests\n- Update to version 0.0.1+git.1601999695.6141130:\n  * README: add user provided config\n- Update to version 0.0.1+git.1598948600.9a9eab0:\n  * Replace fdisk with parted in partitioned\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2020-12-14T11:01:21Z","modified":"2025-05-02T04:30:28.457361Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0599-1","title":"Security update for postgresql-jdbc","description":"This update for postgresql-jdbc fixes the following issues:\n\n- CVE-2020-13692: Fixed a XML External Entity vulnerability (bsc#1172746) .\n","status":"published","published":"2021-02-25T09:51:36Z","modified":"2026-02-04T03:45:54.017796Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-5238-1","title":"libpgjava vulnerability","description":"It was discovered that PostgreSQL JDBC Driver incorrectly handled certain\nrequests from external entities. A remote attacker could use this vulnerability\nto cause a denial of service or possibly execute arbitrary code.\n","status":"published","published":"2022-09-06T09:23:07Z","modified":"2026-02-10T04:42:25Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}