PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs.
The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs.
Most of those code execution bugs are memory errors or type confusion, where PostgreSQL handles a value as the wrong data type.
They turn up in PL/Perl and PL/Tcl, text search functions such as ts_rank_cd(), parallel query, logical replication, dblink and statistics import.
Several bug fixes require work after the new binaries are in place.
Administrators using incremental backups should take a new full backup and base later incrementals on it, because several of the fixed bugs could produce corrupt backups.
If you run these tools against databases where other users can create and name objects, update the client binaries along with the server; version 14.25 is the final release of PostgreSQL 14, which gets no further security or bug fixes.
The lowest, a way around the EXECUTE privilege on cast functions, scores 3.1.
Thirty-two of the 52 CVEs carry a CVSS score of 8.8, the highest in the batch.
The pg_dump utility had a SQL injection through not-null constraint names, and its tar-format restore script failed to block psql command injection.
Servers still running it need a plan to move to a supported version.
So should pg_trgm GiST indexes that use gist_trgm_ops, and B-tree indexes on bpchar columns declared without a length.
Anyone who tested 19 should know that RC 2 reverts support for JSON_ARRAY() and JSON_OBJECT() over arrays, composite types and range types in expression indexes, generated columns and partition keys.
What happened
The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs.
Most of those code execution bugs are memory errors or type confusion, where PostgreSQL handles a value as the wrong data type.
They turn up in PL/Perl and PL/Tcl, text search functions such as ts_rank_cd(), parallel query, logical replication, dblink and statistics import.
What changed
Several bug fixes require work after the new binaries are in place.
Administrators using incremental backups should take a new full backup and base later incrementals on it, because several of the fixed bugs could produce corrupt backups.
Who is affected
If you run these tools against databases where other users can create and name objects, update the client binaries along with the server; version 14.25 is the final release of PostgreSQL 14, which gets no further security or bug fixes.
Why it matters
The lowest, a way around the EXECUTE privilege on cast functions, scores 3.1.
Technical details
Thirty-two of the 52 CVEs carry a CVSS score of 8.8, the highest in the batch.
The pg_dump utility had a SQL injection through not-null constraint names, and its tar-format restore script failed to block psql command injection.
Servers still running it need a plan to move to a supported version.
What security teams should do
So should pg_trgm GiST indexes that use gist_trgm_ops, and B-tree indexes on bpchar columns declared without a length.
Anyone who tested 19 should know that RC 2 reverts support for JSON_ARRAY() and JSON_OBJECT() over arrays, composite types and range types in expression indexes, generated columns and partition keys.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.