This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] PostgreSQL fixes a high-severity vulnerability

PostgreSQL versions 17.4, 16.8, 15.12, 14.17 and 13.20 fix a regression of a high-severity vulnerability [1] originally fixed on 13 February 2025 [2][3][4].

PostgreSQL - SQL injection (CVE-2025-1094)
CVSS 8.1 (High)

Due to improper handling of quoting syntax by certain libpq library functions, an unauthenticated remote attacker can carry out an SQL injection attack using specially crafted input, which requires the output of the affected functions to be used to construct input to the interactive psql terminal. A similar flaw in other PostgreSQL command-line tools allows the attack to be performed if client_encoding is set to BIG5 and server_encoding to EUC_TW or MULE_INTERNAL [5]. The original fix led to a regression in which application crashes could occur [1].

The vulnerability is present in product:

  • *:PostgreSQL;>=13,<13.20;>=14,<14.17;>=15,<15.12;>=16,<16.8;>=17,<17.4;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 13. 2. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 20. 2. 2025.

CESNET, z.s.p.o. Logo