Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2026-72274

Опубликовано: 29 сент. 2026
Источник: oracle-oval
Платформа: Oracle Linux 8

Описание

ELSA-2026-72274: postgresql:12 security update (IMPORTANT)

[12.22-12]

  • add postgresql-CVE-2026-18408.patch

[12.22-11]

  • apply backport-of-the-patch-to-fix-CVE-2025-8714.patch

[12.22-10]

  • Backport fixes for multiple CVEs
  • Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669
  • Resolves: CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-14679
  • Resolves: CVE-2026-14680, CVE-2026-15742, CVE-2026-16239, CVE-2026-19385
  • Resolves: CVE-2026-6464, CVE-2026-6471

[12.22-9]

  • Apply patch for CVE-2026-6479 in prep section
  • Resolves: CVE-2026-6479

[12.22-8]

  • Backport fix for CVE-2026-6479 from PostgreSQL 14.23 (SSL/GSS init causes denial of service via uncontrolled recursion)
  • Resolves: CVE-2026-6479

[12.22-7]

  • Backport fix for CVE-2026-6478 from PostgreSQL 14.23
  • Backport fixes for CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473
  • Resolves: RHEL-179790

[12.22-6]

  • Fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

[12.22-5]

  • Fix previous Backport

[12.22-4]

  • Backport CVE-2025-8715

[12.22-3]

  • Fix backport for CVE-2025-1094

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

Module postgresql:12 is enabled

postgresql

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-contrib

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-docs

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-plperl

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-plpython3

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-pltcl

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-server

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-server-devel

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-static

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-test

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-test-rpm-macros

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-upgrade

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-upgrade-devel

12.22-12.module+el8.10.0+91045+f9258fff

Oracle Linux x86_64

Module postgresql:12 is enabled

postgresql

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-contrib

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-docs

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-plperl

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-plpython3

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-pltcl

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-server

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-server-devel

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-static

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-test

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-test-rpm-macros

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-upgrade

12.22-12.module+el8.10.0+91045+f9258fff

postgresql-upgrade-devel

12.22-12.module+el8.10.0+91045+f9258fff

Связанные CVE

CVE-2025-8714
CVE-2026-18408

Ссылки на источники

Связанные уязвимости

rocky логотип

RLSA-2026:72274

rocky
около 1 месяца назад

Important: postgresql:12 security update

ubuntu логотип

CVE-2025-8714

CVSS3: 8.8
ubuntu
около 1 года назад

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

redhat логотип

CVE-2025-8714

CVSS3: 8.8
redhat
около 1 года назад

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

nvd логотип

CVE-2025-8714

CVSS3: 8.8
nvd
около 1 года назад

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

msrc логотип

CVE-2025-8714

CVSS3: 8.8
msrc
около 1 года назад

PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client