{
  "threat_severity" : "Important",
  "public_date" : "2025-08-14T13:00:07Z",
  "bugzilla" : {
    "description" : "postgresql: PostgreSQL code execution in restore operation",
    "id" : "2388553",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2388553"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-829",
  "details" : [ "Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands.  pg_dumpall is also affected.  pg_restore is affected when used to generate a plain-format dump.  This is similar to MySQL CVE-2024-21096.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.", "A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pg_dump, pg_dumpall, and pg_restore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to untrusted data inclusion." ],
  "statement" : "To exploit this flaw, a PostgreSQL user with special privileges needs to inject arbitrary code in a dump file. The malicious code will only be executed on the client machine when a user restore the crafted dump file. Due to these reasons, this vulnerability has been rated with an Important severity.\nAdditionally, pg_restore is affected only when used to generate a plain-format dump.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14826",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "postgresql16-0:16.10-1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2025-09-17T00:00:00Z",
    "advisory" : "RHSA-2025:16099",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "postgresql-0:9.2.24-9.el7_9.4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14899",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "postgresql:16-8100020250818110346.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15021",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "postgresql:13-8100020250818110147.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15022",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "postgresql:15-8100020250818110305.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-09-03T00:00:00Z",
    "advisory" : "RHSA-2025:15115",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "postgresql:12-8100020250829093521.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.2 Advanced Update Support",
    "release_date" : "2025-09-04T00:00:00Z",
    "advisory" : "RHSA-2025:15361",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.2",
    "package" : "postgresql:12-8020020250826135918.4cda2c84"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15034",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "postgresql:12-8040020250820054803.522a0ee4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15057",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.4",
    "package" : "postgresql:13-8040020250818170654.522a0ee4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15006",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "postgresql:12-8060020250820072728.ad008a3a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
    "release_date" : "2025-09-04T00:00:00Z",
    "advisory" : "RHSA-2025:15359",
    "cpe" : "cpe:/a:redhat:rhel_aus:8.6",
    "package" : "postgresql:13-8060020250825094024.ad008a3a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15006",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "postgresql:12-8060020250820072728.ad008a3a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
    "release_date" : "2025-09-04T00:00:00Z",
    "advisory" : "RHSA-2025:15359",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.6",
    "package" : "postgresql:13-8060020250825094024.ad008a3a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15006",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "postgresql:12-8060020250820072728.ad008a3a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
    "release_date" : "2025-09-04T00:00:00Z",
    "advisory" : "RHSA-2025:15359",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.6",
    "package" : "postgresql:13-8060020250825094024.ad008a3a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15012",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "postgresql:12-8080020250819150429.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15013",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "postgresql:13-8080020250819150623.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15031",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "postgresql:15-8080020250815150643.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15012",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "postgresql:12-8080020250819150429.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15013",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "postgresql:13-8080020250819150623.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15031",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "postgresql:15-8080020250815150643.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14827",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "postgresql:16-9060020250817200213.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14862",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "postgresql:15-9060020250817180313.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14878",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "postgresql-0:13.22-1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14870",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.0",
    "package" : "postgresql-0:13.22-1.el9_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-08-28T00:00:00Z",
    "advisory" : "RHSA-2025:14869",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "postgresql-0:13.22-1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15062",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "postgresql:15-9020020250815141744.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15014",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "postgresql:15-9040020250818140154.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-09-02T00:00:00Z",
    "advisory" : "RHSA-2025:15015",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "postgresql:16-9040020250818135852.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-09-03T00:00:00Z",
    "advisory" : "RHSA-2025:15114",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "postgresql-0:13.22-1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "postgresql",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-8714\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-8714\nhttps://www.postgresql.org/support/security/CVE-2025-8714/" ],
  "name" : "CVE-2025-8714",
  "mitigation" : {
    "value" : "Do not restore a dump file from a server or user you do not explicitly trust.",
    "lang" : "en:us"
  },
  "csaw" : false
}