8.1

CVE-2025-1094: postgresql-12

CVSS: 8.1v3.1HighDeferred
AliasesALPINE-CVE-2025-1094MGASA-2025-0064SUSE-SU-2025:00614-1
Published 13-02-2025Last modified 14-03-2025
Open JSON

Vulnerability summary

CVE-2025-1094 is a high (CVSS 8.1) vulnerability in postgresql-12. EPSS estimates a 90.03% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
60/100
0100
High · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
90.03%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1metasploit

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-8X2G-HMCP-M78WCGA-939G-CJFP-357X

Timeline

  1. 13-02-2025
    PublishedVulnerability first disclosed.
  2. 14-03-2025
    Last modifiedVulnerability information updated.

Description

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

90.03%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 90.03% on 19-09-2026

19-09-202619-10-2026
EPSS score
90.03%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution

    exploit/linux/http/beyondtrust_pra_rs_unauth_rce

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Suse82 products
  • postgresql13&distro=SUSE Enterprise Storage 7.1< 13.20-150200.5.69.1
  • postgresql13&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 13.20-150200.5.69.1
  • postgresql13&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 13.20-150200.5.69.1
  • postgresql13&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 13.20-150200.5.69.1
  • postgresql13&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 13.20-3.60.1
Redhat48 products
  • libpq< 0:12.7-1.el8_2.2 | < 0:13.20-1.el9_0 | < 0:13.20-1.el9_4 | < 0:13.20-1.el9_2 | < 0:13.20-1.el8_4 | < 0:13.20-1.el8_10 | < 0:13.20-1.el9_5 | < 0:13.20-1.el8_8 | < 0:13.20-1.el8_6
  • libpq-debuginfo< 0:12.7-1.el8_2.2 | < 0:13.20-1.el9_0 | < 0:13.20-1.el9_4 | < 0:13.20-1.el9_2 | < 0:13.20-1.el8_4 | < 0:13.20-1.el8_10 | < 0:13.20-1.el9_5 | < 0:13.20-1.el8_8 | < 0:13.20-1.el8_6
  • libpq-debugsource< 0:12.7-1.el8_2.2 | < 0:13.20-1.el9_0 | < 0:13.20-1.el9_4 | < 0:13.20-1.el9_2 | < 0:13.20-1.el8_4 | < 0:13.20-1.el8_10 | < 0:13.20-1.el9_5 | < 0:13.20-1.el8_8 | < 0:13.20-1.el8_6
  • libpq-devel< 0:12.7-1.el8_2.2 | < 0:13.20-1.el9_0 | < 0:13.20-1.el9_4 | < 0:13.20-1.el9_2 | < 0:13.20-1.el8_4 | < 0:13.20-1.el8_10 | < 0:13.20-1.el9_5 | < 0:13.20-1.el8_8 | < 0:13.20-1.el8_6
  • libpq-devel-debuginfo< 0:12.7-1.el8_2.2 | < 0:13.20-1.el9_0 | < 0:13.20-1.el9_4 | < 0:13.20-1.el9_2 | < 0:13.20-1.el8_4 | < 0:13.20-1.el8_10 | < 0:13.20-1.el9_5 | < 0:13.20-1.el8_8 | < 0:13.20-1.el8_6
Opensuse10 products
  • postgresql13&distro=openSUSE Leap 15.6< 13.20-150600.14.5.2
  • postgresql13&distro=openSUSE Tumbleweed< 13.19-1.1
  • postgresql14&distro=openSUSE Leap 15.6< 14.17-150600.16.14.1
  • postgresql14&distro=openSUSE Tumbleweed< 14.16-1.1
  • postgresql15&distro=openSUSE Leap 15.6< 15.12-150600.16.14.1
Chainguard8 products
  • postgresql-12All versions (No fix recorded)
  • postgresql-13< 13.20-r0
  • postgresql-14< 14.17-r0
  • postgresql-14-clientAll versions (No fix recorded) | < 14.24-r2
  • postgresql-15< 15.12-r0
Wolfi8 products
  • postgresql-12All versions (No fix recorded)
  • postgresql-13< 13.20-r0
  • postgresql-14< 14.17-r0
  • postgresql-14-clientAll versions (No fix recorded) | < 14.24-r2
  • postgresql-15< 15.12-r0
Ubuntu6 products
  • postgresql-10< 10.23-0ubuntu0.18.04.2+esm3
  • postgresql-12< 12.22-0ubuntu0.20.04.2
  • postgresql-14< 14.17-0ubuntu0.22.04.1
  • postgresql-16< 16.8-0ubuntu0.24.04.1
  • postgresql-9.3All versions (No fix recorded)
Alpine4 products
  • postgresql14< 14.17-r0
  • postgresql15< 15.11-r0
  • postgresql16< 16.8-r0
  • postgresql17< 17.4-r0
Debian3 products
  • postgresql-13< 13.19-0+deb11u1 | < 13.20-0+deb11u1
  • postgresql-15< 15.11-0+deb12u1
  • postgresql-17< 17.3-1
Mageia2 products
  • postgresql13< 13.19-1.mga9
  • postgresql15< 15.11-1.mga9

9 vendors · 171 products

References

103 links
Show all 100 references

Showing 100 of 103. Use Open JSON for the complete list.