Critical Security Update for PostgreSQL:15 - Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2025:14862: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-2.module_el9.5.0+119+18833d03. Fixed in 1.4.8-2.module_el9.5.0+119+18833d03. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, subselects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code during the restore operation, posing significant risks to database integrity and security.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL (CVE-2025-8714 and CVE-2025-8715) allow for arbitrary code execution during the restore operation. This occurs when the database processes maliciously crafted input, leading to potential unauthorized access and manipulation of the database. The vulnerabilities stem from flaws in the restore functionality, which can be exploited by attackers to execute arbitrary code on the server, compromising the entire database system.
How To Fix
Minimum fixed version
1.4.8-2.module_el9.5.0+119+18833d03
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the restore operation with untrusted or potentially malicious input until the update has been applied. Regularly review and sanitize input data to mitigate risks.
Conclusion
The identified vulnerabilities in PostgreSQL pose a significant risk, allowing for arbitrary code execution during restore operations. It is crucial to update to the patched version to mitigate these risks. Regular monitoring and input validation are recommended to enhance security.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities CVE-2025-8714 and CVE-2025-8715 allow for arbitrary code execution during the restore operation.
You can check your PostgreSQL version and compare it with the patched version. Additionally, using tools like Vulert can help monitor for vulnerabilities.
If an immediate update is not possible, avoid using the restore operation with untrusted data and implement input validation.
Detailed information can be found in the CVE entries for CVE-2025-8714 and CVE-2025-8715, as well as in the advisory linked in the vulnerability report.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, making it easier to stay informed.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
