Amazon Linux 2 Security Advisory: ALAS2-2025-3035
Advisory Released Date: 2025-10-14
Advisory Updated Date: 2025-10-14
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. (CVE-2025-8714)
Affected Packages:
postgresql
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update postgresql or yum update --advisory ALAS2-2025-3035 to update your system.
aarch64:
postgresql-9.2.24-8.amzn2.0.8.aarch64
postgresql-libs-9.2.24-8.amzn2.0.8.aarch64
postgresql-server-9.2.24-8.amzn2.0.8.aarch64
postgresql-docs-9.2.24-8.amzn2.0.8.aarch64
postgresql-contrib-9.2.24-8.amzn2.0.8.aarch64
postgresql-devel-9.2.24-8.amzn2.0.8.aarch64
postgresql-static-9.2.24-8.amzn2.0.8.aarch64
postgresql-upgrade-9.2.24-8.amzn2.0.8.aarch64
postgresql-plperl-9.2.24-8.amzn2.0.8.aarch64
postgresql-plpython-9.2.24-8.amzn2.0.8.aarch64
postgresql-pltcl-9.2.24-8.amzn2.0.8.aarch64
postgresql-test-9.2.24-8.amzn2.0.8.aarch64
postgresql-debuginfo-9.2.24-8.amzn2.0.8.aarch64
i686:
postgresql-9.2.24-8.amzn2.0.8.i686
postgresql-libs-9.2.24-8.amzn2.0.8.i686
postgresql-server-9.2.24-8.amzn2.0.8.i686
postgresql-docs-9.2.24-8.amzn2.0.8.i686
postgresql-contrib-9.2.24-8.amzn2.0.8.i686
postgresql-devel-9.2.24-8.amzn2.0.8.i686
postgresql-static-9.2.24-8.amzn2.0.8.i686
postgresql-upgrade-9.2.24-8.amzn2.0.8.i686
postgresql-plperl-9.2.24-8.amzn2.0.8.i686
postgresql-plpython-9.2.24-8.amzn2.0.8.i686
postgresql-pltcl-9.2.24-8.amzn2.0.8.i686
postgresql-test-9.2.24-8.amzn2.0.8.i686
postgresql-debuginfo-9.2.24-8.amzn2.0.8.i686
src:
postgresql-9.2.24-8.amzn2.0.8.src
x86_64:
postgresql-9.2.24-8.amzn2.0.8.x86_64
postgresql-libs-9.2.24-8.amzn2.0.8.x86_64
postgresql-server-9.2.24-8.amzn2.0.8.x86_64
postgresql-docs-9.2.24-8.amzn2.0.8.x86_64
postgresql-contrib-9.2.24-8.amzn2.0.8.x86_64
postgresql-devel-9.2.24-8.amzn2.0.8.x86_64
postgresql-static-9.2.24-8.amzn2.0.8.x86_64
postgresql-upgrade-9.2.24-8.amzn2.0.8.x86_64
postgresql-plperl-9.2.24-8.amzn2.0.8.x86_64
postgresql-plpython-9.2.24-8.amzn2.0.8.x86_64
postgresql-pltcl-9.2.24-8.amzn2.0.8.x86_64
postgresql-test-9.2.24-8.amzn2.0.8.x86_64
postgresql-debuginfo-9.2.24-8.amzn2.0.8.x86_64