Summary
[12.22-6.0.1]
- Add backport of CVE-2025-8714 [Orabug: 38667546]
[12.22-6]
- Fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006
[12.22-5]
- Fix previous Backport
[12.22-4]
- Backport CVE-2025-8715
[12.22-3]
- Fix backport for CVE-2025-1094
[12.22-2]
- Backport fix for CVE-2025-1094
[12.22-1]
- Update to 12.22
- Fixes: CVE-2024-10976 CVE-2024-10978
[12.20-1]
- Update to 12.20
- Fix CVE-2024-7348
[12.18-1]
- Update to 12.18
- Fix CVE-2024-0985
[12.17-1]
- Update to version 12.17
Fix: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | postgresql | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-contrib | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-docs | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-plperl | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-plpython3 | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-pltcl | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-server | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-server-devel | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-static | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-test | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-test-rpm-macros | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-upgrade | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
| Oracle Linux · 8 | postgresql-upgrade-devel | 0:12.22-6.0.1.module+el8.10.0+90932+f6d78e3c |
Vulnerabilities 2
-
High 8.8
PostgreSQL server undersizes allocations, via integer wraparound
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applic…
-
Medium 6.5
PostgreSQL discloses MD5-hashed passwords via covert timing channel
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, cu…