Vulnerability-Lookup

UBUNTU-CVE-2025-8715 (CVE-2025-8715)

Vulnerability from osv_ubuntu – Published: 2025-08-14 13:15 – Updated: 2026-04-22 07:53 – Source website

Details

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-8715	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-8715	REPORT
	https://www.postgresql.org/about/news/postgresql-…	REPORT
	https://www.postgresql.org/support/security/CVE-2…	REPORT
	https://ubuntu.com/security/notices/USN-7741-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-client-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-contrib-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-doc-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-plperl-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-plpython-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-plpython3-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-pltcl-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          },
          {
            "binary_name": "postgresql-server-dev-9.3",
            "binary_version": "9.3.24-0ubuntu0.14.04+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "postgresql-9.3",
        "purl": "pkg:deb/ubuntu/postgresql-9.3@9.3.24-0ubuntu0.14.04+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.3.1-1",
        "9.3.2-1",
        "9.3.2-1ubuntu1",
        "9.3.2-1ubuntu2",
        "9.3.3-1",
        "9.3.3-1bzr1",
        "9.3.3-1bzr2",
        "9.3.4-1",
        "9.3.5-0ubuntu0.14.04.1",
        "9.3.6-0ubuntu0.14.04",
        "9.3.7-0ubuntu0.14.04",
        "9.3.8-0ubuntu0.4.04",
        "9.3.9-0ubuntu0.14.04",
        "9.3.10-0ubuntu0.14.04",
        "9.3.11-0ubuntu0.14.04",
        "9.3.12-0ubuntu0.14.04",
        "9.3.13-0ubuntu0.14.04",
        "9.3.14-0ubuntu0.14.04",
        "9.3.15-0ubuntu0.14.04",
        "9.3.16-0ubuntu0.14.04",
        "9.3.17-0ubuntu0.14.04",
        "9.3.18-0ubuntu0.14.04.1",
        "9.3.19-0ubuntu0.14.04",
        "9.3.20-0ubuntu0.14.04",
        "9.3.21-0ubuntu0.14.04",
        "9.3.22-0ubuntu0.14.04",
        "9.3.23-0ubuntu0.14.04",
        "9.3.24-0ubuntu0.14.04",
        "9.3.24-0ubuntu0.14.04+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-client-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-contrib-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-doc-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-plperl-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-plpython-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-plpython3-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-pltcl-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          },
          {
            "binary_name": "postgresql-server-dev-9.5",
            "binary_version": "9.5.25-0ubuntu0.16.04.1+esm10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "postgresql-9.5",
        "purl": "pkg:deb/ubuntu/postgresql-9.5@9.5.25-0ubuntu0.16.04.1+esm10?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.5.0-1",
        "9.5.0-2",
        "9.5.0-3",
        "9.5.1-1",
        "9.5.2-1",
        "9.5.3-0ubuntu0.16.04",
        "9.5.4-0ubuntu0.16.04",
        "9.5.5-0ubuntu0.16.04",
        "9.5.6-0ubuntu0.16.04",
        "9.5.7-0ubuntu0.16.04",
        "9.5.8-0ubuntu0.16.04.1",
        "9.5.9-0ubuntu0.16.04",
        "9.5.10-0ubuntu0.16.04",
        "9.5.11-0ubuntu0.16.04",
        "9.5.12-0ubuntu0.16.04",
        "9.5.13-0ubuntu0.16.04",
        "9.5.14-0ubuntu0.16.04",
        "9.5.16-0ubuntu0.16.04.1",
        "9.5.17-0ubuntu0.16.04.1",
        "9.5.18-0ubuntu0.16.04.1",
        "9.5.19-0ubuntu0.16.04.1",
        "9.5.21-0ubuntu0.16.04.1",
        "9.5.23-0ubuntu0.16.04.1",
        "9.5.24-0ubuntu0.16.04.1",
        "9.5.25-0ubuntu0.16.04.1",
        "9.5.25-0ubuntu0.16.04.1+esm1",
        "9.5.25-0ubuntu0.16.04.1+esm2",
        "9.5.25-0ubuntu0.16.04.1+esm3",
        "9.5.25-0ubuntu0.16.04.1+esm4",
        "9.5.25-0ubuntu0.16.04.1+esm5",
        "9.5.25-0ubuntu0.16.04.1+esm6",
        "9.5.25-0ubuntu0.16.04.1+esm7",
        "9.5.25-0ubuntu0.16.04.1+esm8",
        "9.5.25-0ubuntu0.16.04.1+esm10"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-client-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-doc-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-plperl-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-plpython-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-plpython3-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-pltcl-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          },
          {
            "binary_name": "postgresql-server-dev-10",
            "binary_version": "10.23-0ubuntu0.18.04.2+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "postgresql-10",
        "purl": "pkg:deb/ubuntu/postgresql-10@10.23-0ubuntu0.18.04.2+esm3?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1-1",
        "10.1-2",
        "10.2-1",
        "10.3-1",
        "10.4-0ubuntu0.18.04",
        "10.5-0ubuntu0.18.04",
        "10.6-0ubuntu0.18.04.1",
        "10.7-0ubuntu0.18.04.1",
        "10.8-0ubuntu0.18.04.1",
        "10.9-0ubuntu0.18.04.1",
        "10.10-0ubuntu0.18.04.1",
        "10.12-0ubuntu0.18.04.1",
        "10.14-0ubuntu0.18.04.1",
        "10.15-0ubuntu0.18.04.1",
        "10.16-0ubuntu0.18.04.1",
        "10.17-0ubuntu0.18.04.1",
        "10.18-0ubuntu0.18.04.1",
        "10.19-0ubuntu0.18.04.1",
        "10.20-0ubuntu0.18.04.1",
        "10.21-0ubuntu0.18.04.1",
        "10.22-0ubuntu0.18.04.1",
        "10.23-0ubuntu0.18.04.1",
        "10.23-0ubuntu0.18.04.2",
        "10.23-0ubuntu0.18.04.2+esm1",
        "10.23-0ubuntu0.18.04.2+esm2",
        "10.23-0ubuntu0.18.04.2+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "postgresql-12",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "postgresql-client-12",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "postgresql-doc-12",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "postgresql-plperl-12",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "postgresql-plpython3-12",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "postgresql-pltcl-12",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          },
          {
            "binary_name": "postgresql-server-dev-12",
            "binary_version": "12.22-0ubuntu0.20.04.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "postgresql-12",
        "purl": "pkg:deb/ubuntu/postgresql-12@12.22-0ubuntu0.20.04.4?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0-1",
        "12.1-1",
        "12.1-2build1",
        "12.2-1",
        "12.2-1ubuntu2",
        "12.2-4",
        "12.4-0ubuntu0.20.04.1",
        "12.5-0ubuntu0.20.04.1",
        "12.6-0ubuntu0.20.04.1",
        "12.7-0ubuntu0.20.04.1",
        "12.8-0ubuntu0.20.04.1",
        "12.9-0ubuntu0.20.04.1",
        "12.10-0ubuntu0.20.04.1",
        "12.11-0ubuntu0.20.04.1",
        "12.12-0ubuntu0.20.04.1",
        "12.13-0ubuntu0.20.04.1",
        "12.14-0ubuntu0.20.04.1",
        "12.15-0ubuntu0.20.04.1",
        "12.16-0ubuntu0.20.04.1",
        "12.17-0ubuntu0.20.04.1",
        "12.18-0ubuntu0.20.04.1",
        "12.19-0ubuntu0.20.04.1",
        "12.20-0ubuntu0.20.04.1",
        "12.22-0ubuntu0.20.04.1",
        "12.22-0ubuntu0.20.04.2",
        "12.22-0ubuntu0.20.04.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-client-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-doc-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-plperl-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-plpython3-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-pltcl-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-server-dev-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "postgresql-14",
        "purl": "pkg:deb/ubuntu/postgresql-14@14.19-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.19-0ubuntu0.22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "14.1-1ubuntu1",
        "14.2-1",
        "14.2-1ubuntu1",
        "14.3-0ubuntu0.22.04.1",
        "14.4-0ubuntu0.22.04.1",
        "14.5-0ubuntu0.22.04.1",
        "14.6-0ubuntu0.22.04.1",
        "14.7-0ubuntu0.22.04.1",
        "14.8-0ubuntu0.22.04.1",
        "14.9-0ubuntu0.22.04.1",
        "14.10-0ubuntu0.22.04.1",
        "14.11-0ubuntu0.22.04.1",
        "14.12-0ubuntu0.22.04.1",
        "14.13-0ubuntu0.22.04.1",
        "14.15-0ubuntu0.22.04.1",
        "14.17-0ubuntu0.22.04.1",
        "14.18-0ubuntu0.22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-client-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-doc-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-plperl-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-plpython3-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-pltcl-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-server-dev-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "postgresql-16",
        "purl": "pkg:deb/ubuntu/postgresql-16@16.10-0ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.10-0ubuntu0.24.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "16.0-2",
        "16.1-1",
        "16.1-1build1",
        "16.1-1build3",
        "16.2-1",
        "16.2-1ubuntu2",
        "16.2-1ubuntu3",
        "16.2-1ubuntu4",
        "16.3-0ubuntu0.24.04.1",
        "16.4-0ubuntu0.24.04.1",
        "16.4-0ubuntu0.24.04.2",
        "16.6-0ubuntu0.24.04.1",
        "16.8-0ubuntu0.24.04.1",
        "16.9-0ubuntu0.24.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "postgresql-17",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "postgresql-client-17",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "postgresql-doc-17",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "postgresql-plperl-17",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "postgresql-plpython3-17",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "postgresql-pltcl-17",
            "binary_version": "17.6-1"
          },
          {
            "binary_name": "postgresql-server-dev-17",
            "binary_version": "17.6-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "postgresql-17",
        "purl": "pkg:deb/ubuntu/postgresql-17@17.6-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "17.4-1",
        "17.4-2",
        "17.5-1",
        "17.5-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name.  The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.  Versions before 11.20 are unaffected.  CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.",
  "id": "UBUNTU-CVE-2025-8715",
  "modified": "2026-04-22T07:53:19Z",
  "published": "2025-08-14T13:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-8715"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8715"
    },
    {
      "type": "REPORT",
      "url": "https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/"
    },
    {
      "type": "REPORT",
      "url": "https://www.postgresql.org/support/security/CVE-2025-8715/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7741-1"
    }
  ],
  "related": [
    "USN-7741-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-8715"
  ]
}

CVE-2025-8715 (GCVE-0-2025-8715)

Vulnerability from cvelistv5 – Published: 2025-08-14 13:00 – Updated: 2026-02-26 17:48

Title

PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-15 03:55 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 67/100 over 100 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 17 , < 17.6 (rpm) Affected: 16 , < 16.10 (rpm) Affected: 15 , < 15.14 (rpm) Affected: 14 , < 14.19 (rpm) Affected: 11.20 , < 13.22 (rpm)

Credits

The PostgreSQL project thanks Noah Misch for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8715",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-15T03:55:57.753539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:48:36.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "17.6",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.10",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.14",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.19",
              "status": "affected",
              "version": "14",
              "versionType": "rpm"
            },
            {
              "lessThan": "13.22",
              "status": "affected",
              "version": "11.20",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker can direct pg_dump to a chosen origin server or has permission to create non-temporary objects in at least one schema that pg_dump will export"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Noah Misch for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name.  The same attacks can achieve SQL injection as a superuser of the restore target server.  pg_dumpall, pg_restore, and pg_upgrade are also affected.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.  Versions before 11.20 are unaffected.  CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T13:00:07.753Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2025-8715/"
        }
      ],
      "title": "PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server",
      "workarounds": [
        {
          "lang": "en",
          "value": "To block attacks against the psql client, use \"pg_restore --dbname\" instead of restore methods that involve \"psql\".  To block SQL injection against the restore target server, revoke the CREATE permission from non-superusers at the origin server."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2025-8715",
    "datePublished": "2025-08-14T13:00:07.753Z",
    "dateReserved": "2025-08-07T16:39:47.692Z",
    "dateUpdated": "2026-02-26T17:48:36.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

USN-7741-1 (UBUNTU-CVE-2025-8713)

Vulnerability from osv_ubuntu – Published: 2025-09-08 14:23 – Updated: 2026-04-27 14:11 – Source website

Summary

postgresql-14, postgresql-16, postgresql-17 vulnerabilities

Details

Dean Rasheed discovered that PostgreSQL incorrectly handled access control lists. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-8713)

Martin Rakhmanov, Matthieu Denais, and RyotaK discovered that the PostgreSQL pg_dump utility allowed untrusted data inclusion. A malicious superuser could use this issue to execute arbitrary code when a dump script is reloaded. (CVE-2025-8714)

Noah Misch discovered that the PostgreSQL pg_dump utility incorrectly filtered line breaks in object names. An attacker could create object names that execute arbitrary SQL commands when a dump script is reloaded. (CVE-2025-8715)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7741-1	ADVISORY
	https://ubuntu.com/security/CVE-2025-8713	REPORT
	https://ubuntu.com/security/CVE-2025-8714	REPORT
	https://ubuntu.com/security/CVE-2025-8715	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-8713",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-8714",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-8715",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-client-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-doc-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-plperl-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-plpython3-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-pltcl-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "postgresql-server-dev-14",
            "binary_version": "14.19-0ubuntu0.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "postgresql-14",
        "purl": "pkg:deb/ubuntu/postgresql-14@14.19-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.19-0ubuntu0.22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "14.1-1ubuntu1",
        "14.2-1",
        "14.2-1ubuntu1",
        "14.3-0ubuntu0.22.04.1",
        "14.4-0ubuntu0.22.04.1",
        "14.5-0ubuntu0.22.04.1",
        "14.6-0ubuntu0.22.04.1",
        "14.7-0ubuntu0.22.04.1",
        "14.8-0ubuntu0.22.04.1",
        "14.9-0ubuntu0.22.04.1",
        "14.10-0ubuntu0.22.04.1",
        "14.11-0ubuntu0.22.04.1",
        "14.12-0ubuntu0.22.04.1",
        "14.13-0ubuntu0.22.04.1",
        "14.15-0ubuntu0.22.04.1",
        "14.17-0ubuntu0.22.04.1",
        "14.18-0ubuntu0.22.04.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-8713",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-8714",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-8715",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libecpg-compat3",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libecpg6",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libpgtypes3",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "libpq5",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-client-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-doc-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-plperl-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-plpython3-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-pltcl-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          },
          {
            "binary_name": "postgresql-server-dev-16",
            "binary_version": "16.10-0ubuntu0.24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "postgresql-16",
        "purl": "pkg:deb/ubuntu/postgresql-16@16.10-0ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.10-0ubuntu0.24.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "16.0-2",
        "16.1-1",
        "16.1-1build1",
        "16.1-1build3",
        "16.2-1",
        "16.2-1ubuntu2",
        "16.2-1ubuntu3",
        "16.2-1ubuntu4",
        "16.3-0ubuntu0.24.04.1",
        "16.4-0ubuntu0.24.04.1",
        "16.4-0ubuntu0.24.04.2",
        "16.6-0ubuntu0.24.04.1",
        "16.8-0ubuntu0.24.04.1",
        "16.9-0ubuntu0.24.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Dean Rasheed discovered that PostgreSQL incorrectly handled access control\nlists. An attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2025-8713)\n\nMartin Rakhmanov, Matthieu Denais, and RyotaK discovered that the PostgreSQL\npg_dump utility allowed untrusted data inclusion. A malicious superuser\ncould use this issue to execute arbitrary code when a dump script is\nreloaded. (CVE-2025-8714)\n\nNoah Misch discovered that the PostgreSQL pg_dump utility incorrectly\nfiltered line breaks in object names. An attacker could create object names\nthat execute arbitrary SQL commands when a dump script is reloaded.\n(CVE-2025-8715)",
  "id": "USN-7741-1",
  "modified": "2026-04-27T14:11:45Z",
  "published": "2025-09-08T14:23:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7741-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-8713"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-8714"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-8715"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "postgresql-14, postgresql-16, postgresql-17 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2025-8713",
    "UBUNTU-CVE-2025-8714",
    "UBUNTU-CVE-2025-8715"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

UBUNTU-CVE-2025-8715 (CVE-2025-8715)

CVE-2025-8715 (GCVE-0-2025-8715)

USN-7741-1 (UBUNTU-CVE-2025-8713)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour