PT-2025-33269 · Unknown+15 · Pg Upgrade+17
Noah Misch
·
Published
2025-08-13
·
Updated
2026-04-02
·
CVE-2025-8715
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
PostgreSQL versions prior to 17.6
PostgreSQL versions prior to 16.10
PostgreSQL versions prior to 15.14
PostgreSQL versions prior to 14.19
PostgreSQL versions prior to 13.22
Description:
Improper neutralization of newlines in
pg dump allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg dumpall, pg restore, and pg upgrade are also affected.Recommendations:
Update to PostgreSQL version 17.6 or later.
Update to PostgreSQL version 16.10 or later.
Update to PostgreSQL version 15.14 or later.
Update to PostgreSQL version 14.19 or later.
Update to PostgreSQL version 13.22 or later.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Ibm Aix
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node
Pgpdump
Pg Dumpall
Pg Restore
Pg Upgrade
Psql