Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-8714: Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | postgresql | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-contrib | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-debuginfo | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-devel | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-docs | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-libs | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-plperl | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-plpython | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-pltcl | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-server | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-static | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-test | 0:9.2.24-8.amzn2.0.8 |
| Amazon Linux · 2 | postgresql-upgrade | 0:9.2.24-8.amzn2.0.8 |
Vulnerabilities 1
-
High 8.8CVE-2025-8714 Public exploit
PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-8714.html