CVE-2020-17446

CRITICAL

asyncpg < 0.21.0 - Remote Code Execution via Crafted PostgreSQL Server Response

Title source: llm

Description

asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

References (2)

Core 2

Core References

Patch, Release Notes, Third Party Advisory x_refsource_confirm

https://github.com/MagicStack/asyncpg/releases/tag/v0.21.0

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2020/09/msg00002.html

Scores

CVSS v3 9.8

EPSS 0.0242

EPSS Percentile 82.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-824

Status published

Products (3)

debian/debian_linux 9.0

magic/asyncpg < 0.21.0

pypi/asyncpg 0 - 0.21.0PyPI

Published Aug 12, 2020

Tracked Since Feb 18, 2026