PT-2025-33268 · Unknown+13 · Postgresql+12
Martin Rakhmanov
+2
·
Publicado
2025-08-13
·
Atualizado
2026-04-02
·
CVE-2025-8714
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
PostgreSQL versions prior to 17.6
PostgreSQL versions prior to 16.10
PostgreSQL versions prior to 15.14
PostgreSQL versions prior to 14.19
PostgreSQL versions prior to 13.22
Description:
The vulnerability relates to untrusted data inclusion within the
pg dump utility. Exploitation allows a malicious superuser of the origin server to inject arbitrary code for execution during restore operations performed by the psql client. This affects pg dumpall and pg restore when used to generate plain-format dumps. Approximately 3.3 million devices are estimated to be affected. The issue allows for remote code execution.Recommendations:
Update to PostgreSQL version 17.6 or later.
Update to PostgreSQL version 16.10 or later.
Update to PostgreSQL version 15.14 or later.
Update to PostgreSQL version 14.19 or later.
Update to PostgreSQL version 13.22 or later.
As a temporary workaround, use the
--no-comments option during pg restore operations.Correção
RCE
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Debian
Ibm Aix
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node