Skip to content
OpenAdvisories
High ELSA-2025-28019 1 CVE

Important: postgresql security update (Oracle Linux 8)

Published Nov 28, 2025 · Updated Nov 28, 2025

Ecosystem: Oracle Linux

Summary

[12.22-5.0.1]
- Add backport of CVE-2025-8714 [Orabug: 38667546]

[12.22-5]
- Fix previous Backport

[12.22-4]
- Backport CVE-2025-8715

[12.22-3]
- Fix backport for CVE-2025-1094

[12.22-2]
- Backport fix for CVE-2025-1094

[12.22-1]
- Update to 12.22
- Fixes: CVE-2024-10976 CVE-2024-10978

[12.20-1]
- Update to 12.20
- Fix CVE-2024-7348

[12.18-1]
- Update to 12.18
- Fix CVE-2024-0985

[12.17-1]
- Update to version 12.17
Fix: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870

[12.15-3]
- Update postgresql-setup to 8.7 (https://github.com/devexp-db/postgresql-setup/pull/35)

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 8 postgresql 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-contrib 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-docs 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-plperl 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-plpython3 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-pltcl 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-server 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-server-devel 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-static 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-test 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-test-rpm-macros 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-upgrade 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77
Oracle Linux · 8 postgresql-upgrade-devel 0:12.22-5.0.1.module+el8.10.0+90711+f3f8ea77

Vulnerabilities 1

  • High 8.8
    CVE-2025-8714 Public exploit

    PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine