Skip to content
OpenAdvisories
High USN-7315-2 1 CVE

postgresql-10 vulnerability

Published Apr 30, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

USN-7315-1 fixed a vulnerability in PostgreSQL. This update provides the
corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

Stephen Fewer discovered that PostgreSQL incorrectly handled quoting
syntax in certain scenarios. A remote attacker could possibly use this
issue to perform SQL injection attacks.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS postgresql-10 10.23-0ubuntu0.18.04.2+esm3

Vulnerabilities 1

  • High 8.1
    CVE-2025-1094 Public exploit EPSS 90%

    PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

    Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2025-1094