See how postgresql global development group compares to other vendors in security performance
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like sharedpreloadlibraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
End of life: 11/13/2025, Latest version: 13.23
End of life: 11/13/2025, Latest version: 13.23
End of life: 12/5/2011, Latest version: 8.2.23
End of life: 12/5/2011, Latest version: 8.2.23
End of life: 11/8/2018, Latest version: 9.3.25
End of life: 11/8/2018, Latest version: 9.3.25
End of life: 11/21/2024, Latest version: 12.22
End of life: 11/21/2024, Latest version: 12.22
End of life: 11/9/2017, Latest version: 9.2.24
End of life: 11/9/2017, Latest version: 9.2.24
End of life: 2/11/2021, Latest version: 9.5.25
End of life: 2/11/2021, Latest version: 9.5.25
End of life: 11/9/2028, Latest version: 16.15
End of life: 11/9/2028, Latest version: 16.15
End of life: 11/8/2010, Latest version: 8.1.23
End of life: 11/8/2010, Latest version: 8.1.23
End of life: 2/7/2013, Latest version: 8.3.23
End of life: 2/7/2013, Latest version: 8.3.23
End of life: 10/8/2015, Latest version: 9.0.23
End of life: 10/8/2015, Latest version: 9.0.23
End of life: 11/10/2022, Latest version: 10.23
End of life: 11/10/2022, Latest version: 10.23
End of life: 11/9/2023, Latest version: 11.22
End of life: 11/9/2023, Latest version: 11.22
End of life: 10/27/2016, Latest version: 9.1.24
End of life: 10/27/2016, Latest version: 9.1.24
End of life: 11/12/2026, Latest version: 14.24
End of life: 11/12/2026, Latest version: 14.24