Critical Security Update for PostgreSQL: Quoting API Vulnerability
Summary
ALSA-2025:1743: Important: postgresql:16 security update. Affects pg_repack across 2 version ranges.
< 1.5.1-1.module_el9.5.0+127+50ff03a9
< 1.5.1-1.module_el9.5.0+128+1095dce2
Fixed in 1.5.1-1.module_el9.5.0+127+50ff03a9 or 1.5.1-1.module_el9.5.0+128+1095dce2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, concurrency, and complex queries. However, a recent vulnerability has been identified in its quoting APIs, which could lead to security risks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from PostgreSQL's quoting APIs failing to neutralize quoting syntax in text that does not pass encoding validation. This flaw, identified as CVE-2025-1094, can potentially allow attackers to exploit the database by injecting malicious code through improperly handled input, leading to unauthorized access or data manipulation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.5.1-1.module_el9.5.0+127+50ff03a91.5.1-1.module_el9.5.0+127+50ff03a9 -
< 1.5.1-1.module_el9.5.0+128+1095dce21.5.1-1.module_el9.5.0+128+1095dce2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, it is advisable to limit access to the PostgreSQL database and validate all inputs rigorously to prevent potential exploitation until the packages are updated.
Conclusion
In summary, the identified vulnerability in PostgreSQL's quoting APIs poses a significant security risk that must be addressed through timely updates to the affected packages. By following the recommended steps to update and applying necessary workarounds, users can safeguard their databases against potential exploits.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2025-1094 is a security vulnerability in PostgreSQL's quoting APIs that fails to neutralize quoting syntax in improperly encoded text.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any installation.
Failing to address this vulnerability could lead to unauthorized access, data manipulation, or other security breaches within your PostgreSQL database.
It is recommended to regularly check for updates and apply them promptly to ensure your software is protected against known vulnerabilities.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
