Skip to content
OpenAdvisories
High ELSA-2025-1740 1 CVE

Important: postgresql:16 security update (Oracle Linux 8)

Published Feb 21, 2025 · Updated Feb 21, 2025

Summary

pgaudit
[16.0-1]
- Update to 16.0
- Support postgresql 16
- Initial import for PG 16 module
- Resolves: RHEL-3636

pg_repack
[1.5.1-1]
- Update to 1.5.1

postgres-decoderbufs
[2.4.0-1.Final]
- Initial import for postgresql 16 stream
- Related: RHEL-3636

postgresql
[16.8-1]
- Update to 16.8
- Fix CVE-2025-1094

Fixed packages 18

ReleasePackageFixed in
Oracle Linux · 8 pg_repack 0:1.5.1-1.module+el8.10.0+90451+109c7b24
Oracle Linux · 8 pgaudit 0:16.0-1.module+el8.10.0+90275+c15b12cb
Oracle Linux · 8 postgres-decoderbufs 0:2.4.0-1.Final.module+el8.10.0+90275+c15b12cb
Oracle Linux · 8 postgresql 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-contrib 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-docs 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-plperl 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-plpython3 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-pltcl 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-private-devel 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-private-libs 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-server 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-server-devel 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-static 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-test 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-test-rpm-macros 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-upgrade 0:16.8-1.module+el8.10.0+90530+9eb57222
Oracle Linux · 8 postgresql-upgrade-devel 0:16.8-1.module+el8.10.0+90530+9eb57222

Vulnerabilities 1

  • High 8.1
    CVE-2025-1094 Public exploit EPSS 90%

    PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

    Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL …