Critical Security Update for PostgreSQL:12 - Quoting API Vulnerability
Summary
ALSA-2025:3082: Important: postgresql:12 security update. Affects pg_repack versions < 1.4.6-3.module_el8.9.0+3704+f1f917ce. Fixed in 1.4.6-3.module_el8.9.0+3704+f1f917ce. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, concurrency, and complex queries. However, a recent vulnerability has been identified in its quoting APIs, which may lead to security risks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from PostgreSQL's quoting APIs failing to neutralize quoting syntax in text that does not pass encoding validation. This flaw, identified as CVE-2025-1094, could allow attackers to exploit the database by injecting malicious queries, potentially leading to unauthorized data access or corruption. The implications of this vulnerability are significant, as it compromises the integrity and security of the database system.
How To Fix
Minimum fixed version
1.4.6-3.module_el8.9.0+3704+f1f917ce
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization measures to mitigate the risk of SQL injection attacks. This can include using prepared statements and parameterized queries to ensure that user inputs are handled safely.
Conclusion
The identified vulnerability in PostgreSQL's quoting APIs poses a significant security risk that must be addressed promptly. By updating the affected packages and implementing best practices for input validation, users can safeguard their database systems against potential attacks.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2025-1094 is a vulnerability in PostgreSQL's quoting APIs that fails to neutralize quoting syntax in improperly encoded text, potentially allowing SQL injection attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may lead to unauthorized access, data corruption, and potential breaches of sensitive information.
It is recommended to regularly check for updates and apply security patches as soon as they are released to mitigate vulnerabilities.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
