Skip to content
OpenAdvisories
High ELSA-2026-72274 2 CVEs

Important: postgresql:12 security update (Oracle Linux 8)

Published Sep 29, 2026 · Updated Sep 29, 2026

Ecosystem: Oracle Linux

Summary

[12.22-12]
- add postgresql-CVE-2026-18408.patch

[12.22-11]
- apply backport-of-the-patch-to-fix-CVE-2025-8714.patch

[12.22-10]
- Backport fixes for multiple CVEs
- Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669
- Resolves: CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-14679
- Resolves: CVE-2026-14680, CVE-2026-15742, CVE-2026-16239, CVE-2026-19385
- Resolves: CVE-2026-6464, CVE-2026-6471

[12.22-9]
- Apply patch for CVE-2026-6479 in prep section
- Resolves: CVE-2026-6479

[12.22-8]
- Backport fix for CVE-2026-6479 from PostgreSQL 14.23
(SSL/GSS init causes denial of service via uncontrolled recursion)
- Resolves: CVE-2026-6479

[12.22-7]
- Backport fix for CVE-2026-6478 from PostgreSQL 14.23
- Backport fixes for CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473
- Resolves: RHEL-179790

[12.22-6]
- Fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

[12.22-5]
- Fix previous Backport

[12.22-4]
- Backport CVE-2025-8715

[12.22-3]
- Fix backport for CVE-2025-1094

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 8 postgresql 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-contrib 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-docs 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-plperl 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-plpython3 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-pltcl 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-server 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-server-devel 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-static 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-test 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-test-rpm-macros 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-upgrade 0:12.22-12.module+el8.10.0+91045+f9258fff
Oracle Linux · 8 postgresql-upgrade-devel 0:12.22-12.module+el8.10.0+91045+f9258fff

Vulnerabilities 2

  • High 8.8
    CVE-2025-8714 Public exploit

    PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2026-18408

    PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command in…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi