Summary
[9.2.24-9.0.7]
- Restrict psql meta-commands in plain-text dumps [Orabug: 38442031][CVE-2025-8714]
[9.2.24-9.0.5]
- Resolves CVE-2025-1094: Improper neutralization of quoting syntax in certain
- libpq functions [Orabug: 37843176]
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | postgresql | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-contrib | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-devel | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-docs | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-libs | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-plperl | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-plpython | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-pltcl | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-server | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-static | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-test | 0:9.2.24-9.0.7.el7_9 |
| Oracle Linux · 7 | postgresql-upgrade | 0:9.2.24-9.0.7.el7_9 |
Vulnerabilities 1
-
High 8.8CVE-2025-8714 Public exploit
PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall…