Insufficient Randomness in Directory Name Generation in pgAgent Leads to Job Disruption
Summary
DEBIAN-CVE-2025-0218: When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. Affects pgagent versions < 4.2.3-1. Fixed in 4.2.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAgent is a job scheduling agent for PostgreSQL that allows users to automate the execution of scripts and tasks. It is designed to manage batch jobs, providing a user-friendly interface for scheduling and monitoring tasks. However, versions prior to 4.2.3 have a vulnerability that stems from the use of an insufficiently seeded random number generator when creating temporary directories for executing batch jobs. This flaw can be exploited by local attackers to disrupt scheduled tasks.
Vulnerability Detail
The vulnerability arises from the way pgAgent generates temporary directory names using a random number generator that is not adequately seeded. This can allow a local attacker to pre-create the directory with the same name, preventing pgAgent from executing jobs. As a result, scheduled tasks may fail to run, leading to potential disruptions in automated processes and loss of productivity.
How To Fix
Minimum fixed version
4.2.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pgagentTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually monitor and manage the temporary directories used by pgAgent to ensure that no unauthorized directories are created. However, this is not a long-term solution and updating the package is strongly recommended.
Conclusion
In summary, the vulnerability in pgAgent due to insufficient randomness in directory name generation poses a risk of job disruption by local attackers. Users are advised to update to the patched version 4.2.3-1 or later to secure their systems and ensure the smooth operation of scheduled tasks.
See every vulnerability recorded for pgagent →
FAQ
pgAgent is a job scheduling agent for PostgreSQL that automates the execution of scripts and tasks.
Versions of pgAgent prior to 4.2.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to disruptions in scheduled tasks, as local attackers can prevent pgAgent from executing jobs.
Yes, the patch is included in pgAgent version 4.2.3-1 and later. Users should update to this version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgagent.
