CVE-2025-1094: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when clientencoding is BIG5 and serverencoding is one of EUCTW or MULEINTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
Other sources
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
— Microsoft
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.7-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.16-1 - Upgrade
Upgrade
alpine/postgresql13to a version that resolves this vulnerability.Fixed in 13.20-r0 - Upgrade
Upgrade
alpine/postgresql14to a version that resolves this vulnerability.Fixed in 14.17-r0 - Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.11-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.8-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.4-r0 - Upgrade
Upgrade
debian/postgresql-15to a version that resolves this vulnerability.Fixed in 15.11-0+deb12u1 - Upgrade
Upgrade
debian/postgresql-17to a version that resolves this vulnerability.Fixed in 17.3-1 - Upgrade
Upgrade
debian/postgresql-15to a version that resolves this vulnerability.Fixed in 15.18-0+deb12u1Fixed in 15.19-0+deb12u1 - Upgrade
Upgrade
debian/postgresql-17to a version that resolves this vulnerability.Fixed in 17.11-0+deb13u1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1094?
CVE-2025-1094 is classified as a high-severity vulnerability due to its potential for SQL injection exploitation.
How do I fix CVE-2025-1094?
To mitigate CVE-2025-1094, it is recommended to upgrade PostgreSQL to versions 17.3, 16.7, 15.11, 14.16, or 13.19 or later.
What types of functions are affected by CVE-2025-1094?
CVE-2025-1094 affects the PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() functions in PostgreSQL.
Who is affected by CVE-2025-1094?
Users of PostgreSQL versions below 17.3, 16.7, 15.11, 14.16, and 13.19 are potentially affected by CVE-2025-1094.
What is SQL injection in the context of CVE-2025-1094?
In the context of CVE-2025-1094, SQL injection allows attackers to manipulate queries through improperly sanitized inputs in PostgreSQL libpq functions.