Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
PostgreSQL 16: Authentication Bypass Risk
published 1 year ago
Summary
A security update is available for PostgreSQL 16 to fix a vulnerability that could allow an attacker to bypass authentication and gain access to your database. This update is essential to prevent unauthorized access to your sensitive data. We recommend you update your PostgreSQL 16 installation as soon as possible.
What to do
- Update redhat pg_repack to version 0:1.4.8-1.module+el9.4.0+20427+07482b8c.
- Update redhat pg_repack-debuginfo to version 0:1.4.8-1.module+el9.4.0+20427+07482b8c.
- Update redhat pg_repack-debugsource to version 0:1.4.8-1.module+el9.4.0+20427+07482b8c.
- Update redhat pgaudit to version 0:16.0-1.module+el9.4.0+20427+07482b8c.
- Update redhat pgaudit-debuginfo to version 0:16.0-1.module+el9.4.0+20427+07482b8c.
- Update redhat pgaudit-debugsource to version 0:16.0-1.module+el9.4.0+20427+07482b8c.
- Update redhat postgres-decoderbufs to version 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c.
- Update redhat postgres-decoderbufs-debuginfo to version 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c.
- Update redhat postgres-decoderbufs-debugsource to version 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c.
- Update redhat postgresql to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-contrib to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-contrib-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-debugsource to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-docs to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-docs-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-plperl to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-plperl-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-plpython3 to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-plpython3-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-pltcl to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-pltcl-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-private-devel to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-private-libs to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-private-libs-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-server to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-server-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-server-devel to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-server-devel-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-static to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-test to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-test-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-test-rpm-macros to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-upgrade to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-upgrade-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-upgrade-devel to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
- Update redhat postgresql-upgrade-devel-debuginfo to version 0:16.8-1.module+el9.4.0+22876+364471ad.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_eus:9.4::appstream | redhat | pg_repack |
< 0:1.4.8-1.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:1.4.8-1.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | pg_repack-debuginfo |
< 0:1.4.8-1.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:1.4.8-1.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | pg_repack-debugsource |
< 0:1.4.8-1.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:1.4.8-1.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | pgaudit |
< 0:16.0-1.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:16.0-1.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | pgaudit-debuginfo |
< 0:16.0-1.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:16.0-1.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | pgaudit-debugsource |
< 0:16.0-1.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:16.0-1.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgres-decoderbufs |
< 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgres-decoderbufs-debuginfo |
< 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgres-decoderbufs-debugsource |
< 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c Fix: upgrade to 0:2.4.0-1.Final.module+el9.4.0+20427+07482b8c
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-contrib |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-contrib-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-debugsource |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-docs |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-docs-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-plperl |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-plperl-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-plpython3 |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-plpython3-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-pltcl |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-pltcl-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-private-devel |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-private-libs |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-private-libs-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-server |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-server-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-server-devel |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-server-devel-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-static |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-test |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-test-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-test-rpm-macros |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-upgrade |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-upgrade-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-upgrade-devel |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
| Red Hat:rhel_eus:9.4::appstream | redhat | postgresql-upgrade-devel-debuginfo |
< 0:16.8-1.module+el9.4.0+22876+364471ad.1 Fix: upgrade to 0:16.8-1.module+el9.4.0+22876+364471ad.1
|
Original advisory text
Red Hat Security Advisory: postgresql:16 security update
References
- https://access.redhat.com/errata/RHSA-2025:1731 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2345548 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1731.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-1094 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-1094 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-1094 Vendor Advisory
- https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis Third Party Advisory
- https://www.postgresql.org/support/security/CVE-2025-1094/ Third Party Advisory
- https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-psql-sql-in... Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published21 Feb 2025
Updated12 Jul 2026
First seen12 Jul 2026
Sources
RHSA-2025:1731 · OSV
Track software like this
Free during beta