Skip to content
OpenAdvisories
Medium ALAS2-2025-2902 1 CVE

Moderate: postgresql security update (Amazon Linux 2)

Published Jun 18, 2025 · Updated Jun 24, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-4207: Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2 postgresql 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-contrib 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-debuginfo 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-devel 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-docs 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-libs 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-plperl 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-plpython 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-pltcl 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-server 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-static 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-test 0:9.2.24-8.amzn2.0.7
Amazon Linux · 2 postgresql-upgrade 0:9.2.24-8.amzn2.0.7

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-4207

    PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

    Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions …

    rust postgresql-9.3 postgresql15 postgresql-9.5 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-4207.html