Skip to content
OpenAdvisories
High ELSA-2025-3978 1 CVE

Important: postgresql security update (Oracle Linux 7)

Published Jun 18, 2025 · Updated Jun 18, 2025

Ecosystem: Oracle Linux

Summary

[9.2.24-9.0.5]
- Resolves CVE-2025-1094: Improper neutralization of quoting syntax in certain
- libpq functions [Orabug: 37843176]

Fixed packages 12

ReleasePackageFixed in
Oracle Linux · 7 postgresql 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-contrib 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-devel 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-docs 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-libs 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-plperl 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-plpython 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-pltcl 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-server 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-static 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-test 0:9.2.24-9.0.5.el7_9
Oracle Linux · 7 postgresql-upgrade 0:9.2.24-9.0.5.el7_9

Vulnerabilities 1

  • High 8.1
    CVE-2025-1094 Public exploit EPSS 90%

    PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

    Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi