Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-testUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-staticUpgrade pgauditUpgrade postgresql-private-develUpgrade postgresql-plpython3Upgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade pgvectorUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macros | Sep 1, 2025 | Aug 28, 2025 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql16Upgrade postgresql17 | Aug 18, 2025 | Aug 14, 2025 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresqlUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-private-libsUpgrade postgresql-plperlUpgrade postgresql-private-develUpgrade postgresql-llvmjitUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-pltcl | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql17-upgrade-develUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql17-testUpgrade postgresql15-plperlUpgrade postgresql15-upgrade-develUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql16-docs-debuginfoUpgrade postgresql17-pltclUpgrade postgresql16-contrib-debuginfoUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql15-server-develUpgrade postgresql17-private-libsUpgrade postgresql17-upgradeUpgrade postgresql15-docsUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql15Upgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql17-test-rpm-macrosUpgrade postgresql16-debuginfoUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql16-pltclUpgrade postgresql15-debugsourceUpgrade postgresql16Upgrade postgresql15-testUpgrade postgresql16-plperl-debuginfoUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql16-server-debuginfoUpgrade postgresql15-pltclUpgrade postgresql17-contribUpgrade postgresql17-debugsourceUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql17-private-develUpgrade postgresql15-test-rpm-macrosUpgrade postgresql16-debugsourceUpgrade postgresql17-server-debuginfoUpgrade postgresql16-private-develUpgrade postgresql15-private-develUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql16-upgrade-develUpgrade postgresql17-server-develUpgrade postgresql15-contribUpgrade postgresql17-docsUpgrade postgresql16-testUpgrade postgresql17-plperlUpgrade postgresql15-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql17-serverUpgrade postgresql15-llvmjitUpgrade postgresql17-llvmjitUpgrade postgresql17-contrib-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql17-docs-debuginfoUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql16-contribUpgrade postgresql16-plperlUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql16-server-develUpgrade postgresql16-docsUpgrade postgresql16-private-libsUpgrade postgresql16-llvmjitUpgrade postgresql15-staticUpgrade postgresql16-test-rpm-macrosUpgrade postgresql16-staticUpgrade postgresql17Upgrade postgresql17-debuginfoUpgrade postgresql17-plpython3Upgrade postgresql16-serverUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql17-staticUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql16-plpython3Upgrade postgresql15-docs-debuginfoUpgrade postgresql16-upgradeUpgrade postgresql16-test-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql17-plperl-debuginfoUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql15-serverUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql17-test-debuginfoUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-plperl-debuginfo | Sep 9, 2025 | Aug 14, 2025 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-17Upgrade postgresql-15 | Aug 18, 2025 | Aug 18, 2025 |
| Freebsd | — | Upgrade postgresql16-serverUpgrade postgresql15-serverUpgrade postgresql17-serverUpgrade postgresql14-serverUpgrade postgresql13-server | Dec 10, 2025 | Aug 14, 2025 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Oracle_linux | — | Upgrade postgresql-upgrade-develUpgrade pgvectorUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-docsUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade pg_repackUpgrade postgresql-pltclUpgrade postgres-decoderbufsUpgrade postgresqlUpgrade postgresql-private-libsUpgrade pgauditUpgrade postgresql-serverUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-private-devel | Sep 2, 2025 | Aug 14, 2025 |
| Postgres | — | Upgrade to PostgreSQL version 16.10Upgrade to PostgreSQL version 14.19Upgrade to PostgreSQL version 17.6Upgrade to PostgreSQL version 15.14 | Aug 15, 2025 | Aug 14, 2025 |
| Redhat_linux | — | Upgrade postgresql-plperlUpgrade pgvector-debugsourceUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade pgvectorUpgrade postgresql-pltclUpgrade pgaudit-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql16-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-contribUpgrade postgresql-private-libs-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pg_repackUpgrade postgresql-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgvector-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-private-develUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade pgauditUpgrade postgresql-server-debuginfoNo solution existsUpgrade postgresqlUpgrade pg_repack-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-contrib-debuginfoUpgrade postgresql-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-docsUpgrade postgresql-private-libsUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-test-debuginfo | Sep 1, 2025 | Aug 14, 2025 |
| Rocky_linux | — | Upgrade pgaudit-debugsourceUpgrade postgresql16-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pgvectorUpgrade postgresql-testUpgrade pg_repack-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade postgresql-serverUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docsUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debugsourceUpgrade pgvector-debuginfoUpgrade postgresql-debuginfoUpgrade pg_repackUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-private-libsUpgrade pgauditUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-private-libs-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql-private-develUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufsUpgrade pgvector-debugsourceUpgrade postgresql-staticUpgrade postgresql-debugsource | Feb 5, 2026 | Sep 8, 2025 |
| Suse | — | Upgrade postgresql13-testUpgrade postgresql17-docsUpgrade postgresql13-server-develUpgrade postgresql16-pltclUpgrade postgresql14-llvmjit-develUpgrade postgresql14-contribUpgrade postgresql14-plperlUpgrade postgresql15-server-develUpgrade postgresql14-plpythonUpgrade postgresql14-server-develUpgrade postgresql16-llvmjit-develUpgrade postgresql13-llvmjit-develUpgrade postgresql16-serverUpgrade postgresql14Upgrade postgresql17-server-develUpgrade postgresql16-server-develUpgrade postgresql17-develUpgrade postgresql13-pltclUpgrade postgresql15-llvmjitUpgrade postgresql13-docsUpgrade postgresql16-docsUpgrade postgresql15Upgrade postgresql16-contribUpgrade libpq5-32bitUpgrade postgresql15-develUpgrade postgresql17-serverUpgrade libecpg6Upgrade postgresql13Upgrade postgresql15-plperlUpgrade postgresql13-contribUpgrade postgresql15-llvmjit-develUpgrade postgresql17-llvmjit-develUpgrade postgresql13-serverUpgrade postgresql14-develUpgrade postgresql16-llvmjitUpgrade postgresql13-develUpgrade postgresql17-llvmjitUpgrade postgresql13-llvmjitUpgrade postgresql17-contribUpgrade postgresql16-testUpgrade postgresql16-plperlUpgrade postgresql14-llvmjitUpgrade postgresql15-serverUpgrade postgresql15-docsUpgrade postgresql14-pltclUpgrade postgresql17-testUpgrade postgresql17-plpythonUpgrade postgresql17-plperlUpgrade libecpg6-32bitUpgrade postgresql15-pltclUpgrade postgresql14-serverUpgrade postgresql16-plpythonUpgrade postgresql16-develUpgrade postgresql13-plperlUpgrade libpq5Upgrade postgresql15-testUpgrade postgresql15-contribUpgrade postgresql14-testUpgrade postgresql14-docsUpgrade postgresql13-plpythonUpgrade postgresql15-plpythonUpgrade postgresql17-pltclUpgrade postgresql17Upgrade postgresql16 | Dec 5, 2025 | Aug 29, 2025 |
| Ubuntu | — | Upgrade postgresql-client-14Upgrade postgresql-client-17Upgrade postgresql-16Upgrade postgresql-17Upgrade postgresql-client-16Upgrade postgresql-14 | Sep 9, 2025 | Aug 14, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 22, 2025 | Aug 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub