Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade pgvectorUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgresql-staticUpgrade pgaudit | Sep 1, 2025 | Aug 28, 2025 |
| Alpine Linux | — | Upgrade postgresql17Upgrade postgresql16Upgrade postgresql15 | Aug 18, 2025 | Aug 14, 2025 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-debuginfoUpgrade postgresql-pltclUpgrade postgresql-llvmjitUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macros | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql17-staticUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql16-plpython3Upgrade postgresql17-docs-debuginfoUpgrade postgresql17-serverUpgrade postgresql17Upgrade postgresql15-docs-debuginfoUpgrade postgresql17-debuginfoUpgrade postgresql17-plpython3Upgrade postgresql16-test-debuginfoUpgrade postgresql16-staticUpgrade postgresql15-upgradeUpgrade postgresql17-llvmjitUpgrade postgresql16-upgradeUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql16-test-rpm-macrosUpgrade postgresql16-docsUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql17-plperl-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-llvmjitUpgrade postgresql16-serverUpgrade postgresql15-plpython3Upgrade postgresql15-private-libsUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-contribUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql17-contrib-debuginfoUpgrade postgresql15-staticUpgrade postgresql16-private-libsUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql16-server-develUpgrade postgresql17-test-debuginfoUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql16-llvmjitUpgrade postgresql16-plperlUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql16-server-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-pltclUpgrade postgresql17-server-debuginfoUpgrade postgresql16-plperl-debuginfoUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql17-server-develUpgrade postgresql17-test-rpm-macrosUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15Upgrade postgresql17-docsUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql15-testUpgrade postgresql16-pltclUpgrade postgresql17-testUpgrade postgresql15-debugsourceUpgrade postgresql16-testUpgrade postgresql16-upgrade-develUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql17-private-develUpgrade postgresql16-debugsourceUpgrade postgresql15-private-develUpgrade postgresql17-debugsourceUpgrade postgresql15-debuginfoUpgrade postgresql15-contribUpgrade postgresql17-contribUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql16-contrib-debuginfoUpgrade postgresql16Upgrade postgresql15-upgrade-develUpgrade postgresql15-test-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-server-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-docsUpgrade postgresql17-upgradeUpgrade postgresql17-private-libsUpgrade postgresql17-pltclUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql16-docs-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql17-upgrade-develUpgrade postgresql17-plperlUpgrade postgresql16-private-develUpgrade postgresql17-private-libs-debuginfo | Sep 9, 2025 | Aug 14, 2025 |
| Debian | — | Upgrade postgresql-17Upgrade postgresql-15Upgrade postgresql-13 | Aug 18, 2025 | Aug 18, 2025 |
| Freebsd | — | Upgrade postgresql15-serverUpgrade postgresql16-serverUpgrade postgresql13-serverUpgrade postgresql14-serverUpgrade postgresql17-server | Dec 10, 2025 | Aug 14, 2025 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade pg_repackUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-private-develUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade pgvectorUpgrade postgresql-static | Sep 2, 2025 | Aug 14, 2025 |
| Postgres | — | Upgrade to PostgreSQL version 17.6Upgrade to PostgreSQL version 14.19Upgrade to PostgreSQL version 15.14Upgrade to PostgreSQL version 16.10 | Aug 15, 2025 | Aug 14, 2025 |
| Redhat_linux | — | Upgrade postgresql-contrib-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgresql-serverUpgrade postgresql-private-libsUpgrade postgresql-test-debuginfoNo solution existsUpgrade postgresql-debugsourceUpgrade postgresql-private-develUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresql-docsUpgrade pgvector-debuginfoUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql16-debuginfoUpgrade pg_repackUpgrade postgresql-plperl-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3Upgrade postgresql16-debugsourceUpgrade postgresql-pltclUpgrade postgresql-upgrade-debuginfoUpgrade pgaudit-debugsourceUpgrade pgvector-debugsourceUpgrade pg_repack-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-debuginfoUpgrade pgvectorUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plperl | Sep 1, 2025 | Aug 14, 2025 |
| Rocky_linux | — | Upgrade postgresqlUpgrade pg_repack-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-testUpgrade postgresql16-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade pgaudit-debuginfoUpgrade pgvectorUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-plperlUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debugsourceUpgrade pg_repackUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-docsUpgrade postgresql-debugsourceUpgrade postgresql-staticUpgrade postgres-decoderbufsUpgrade postgresql16-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contribUpgrade pgvector-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-private-libsUpgrade pgauditUpgrade postgresql-private-develUpgrade postgresql-debuginfoUpgrade postgresql-pltcl-debuginfo | Feb 5, 2026 | Sep 8, 2025 |
| Suse | — | Upgrade postgresql14-plpythonUpgrade postgresql17-develUpgrade postgresql17-llvmjit-develUpgrade postgresql16-serverUpgrade postgresql13-serverUpgrade postgresql14-server-develUpgrade postgresql16-llvmjitUpgrade postgresql16-llvmjit-develUpgrade postgresql16-server-develUpgrade postgresql17-serverUpgrade postgresql16-contribUpgrade postgresql15-plperlUpgrade libecpg6Upgrade postgresql15-llvmjitUpgrade postgresql14-develUpgrade libpq5-32bitUpgrade postgresql13-pltclUpgrade postgresql16-pltclUpgrade postgresql15-server-develUpgrade postgresql17-server-develUpgrade postgresql14-llvmjit-develUpgrade postgresql17-docsUpgrade postgresql13-contribUpgrade postgresql13Upgrade postgresql13-server-develUpgrade postgresql13-llvmjit-develUpgrade postgresql15-develUpgrade postgresql16-docsUpgrade postgresql15-llvmjit-develUpgrade postgresql13-docsUpgrade postgresql15Upgrade postgresql14-plperlUpgrade postgresql14Upgrade postgresql14-contribUpgrade postgresql13-testUpgrade postgresql15-docsUpgrade postgresql15-serverUpgrade postgresql13-plperlUpgrade postgresql13-develUpgrade postgresql16Upgrade postgresql17Upgrade postgresql13-llvmjitUpgrade postgresql17-llvmjitUpgrade postgresql16-plperlUpgrade postgresql14-llvmjitUpgrade postgresql17-testUpgrade postgresql16-testUpgrade postgresql17-contribUpgrade postgresql14-pltclUpgrade postgresql17-plpythonUpgrade postgresql13-plpythonUpgrade postgresql15-plpythonUpgrade postgresql17-plperlUpgrade postgresql17-pltclUpgrade libpq5Upgrade postgresql15-testUpgrade postgresql14-testUpgrade postgresql14-docsUpgrade postgresql15-contribUpgrade postgresql14-serverUpgrade postgresql16-develUpgrade postgresql15-pltclUpgrade libecpg6-32bitUpgrade postgresql16-plpython | Dec 5, 2025 | Aug 29, 2025 |
| Ubuntu | — | Upgrade postgresql-14Upgrade postgresql-client-16Upgrade postgresql-17Upgrade postgresql-client-14Upgrade postgresql-16Upgrade postgresql-client-17 | Sep 9, 2025 | Aug 14, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 22, 2025 | Aug 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub