Critical Security Update for PostgreSQL:15 - Arbitrary Code Execution Vulnerability
Summary
ALSA-2025:15022: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.9.0+3706+885c732e. Fixed in 1.4.8-1.module_el8.9.0+3706+885c732e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and support for complex queries. It is widely used in various applications for data storage and management. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code during the restore operation, posing significant security risks to systems utilizing this database.
Vulnerability Detail
The vulnerabilities identified as CVE-2025-8714 and CVE-2025-8715 allow PostgreSQL to execute arbitrary code during the restore operation. These vulnerabilities arise from improper handling of certain inputs, which can be exploited by attackers to gain unauthorized access or control over the database system. The ramifications of these vulnerabilities are severe, as they could lead to data breaches, loss of data integrity, and unauthorized manipulation of database operations.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.9.0+3706+885c732e
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the restore operation until the update has been applied. Additionally, restricting access to the database and monitoring for unusual activities can help mitigate potential risks.
Conclusion
In summary, PostgreSQL has critical vulnerabilities that could allow for arbitrary code execution during restore operations. It is crucial to update to the patched version to safeguard your systems. Implementing the recommended fixes and workarounds will help mitigate the risks associated with these vulnerabilities.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities, identified as CVE-2025-8714 and CVE-2025-8715, allow for arbitrary code execution during the restore operation.
You can check your PostgreSQL version using the command 'psql --version'. If it is below 15.14, it is vulnerable.
If immediate updates are not possible, avoid using the restore operation and monitor your database for any suspicious activities.
Detailed information can be found on the CVE pages for CVE-2025-8714 and CVE-2025-8715.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
