Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-4207: Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | postgresql17 | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-contrib | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-contrib-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-debugsource | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-docs | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-docs-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-llvmjit | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-llvmjit-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-plperl | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-plperl-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-plpython3 | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-plpython3-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-pltcl | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-pltcl-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-private-devel | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-private-libs | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-private-libs-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-server | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-server-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-server-devel | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-server-devel-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-static | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-test | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-test-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-test-rpm-macros | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-upgrade | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-upgrade-debuginfo | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-upgrade-devel | 0:17.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | postgresql17-upgrade-devel-debuginfo | 0:17.5-1.amzn2023.0.1 |
Vulnerabilities 1
-
Medium 5.9
PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation
Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-4207.html