Bug 34018 - postgresql new security issue CVE-2025-1094
Summary: postgresql new security issue CVE-2025-1094
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-02-14 09:06 CET by Nicolas Salguero
Modified: 2025-02-14 21:37 CET (History)
3 users (show)

See Also:
Source RPM: postgresql15, postgresql13
CVE: CVE-2025-1094
Status comment:


Attachments

Description Nicolas Salguero 2025-02-14 09:06:53 CET
PostgreSQL has released new versions on February 13:
https://www.postgresql.org/about/news/postgresql-173-167-1511-1416-and-1319-released-3015/
Nicolas Salguero 2025-02-14 09:07:33 CET

Source RPM: (none) => postgresql17, postgresql15, postgresql13
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2025-1094

Nicolas Salguero 2025-02-14 09:42:18 CET

Severity: normal => major

Comment 1 Nicolas Salguero 2025-02-14 10:44:31 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation. (CVE-2025-1094)

References:
https://www.postgresql.org/about/news/postgresql-173-167-1511-1416-and-1319-released-3015/
========================

Updated packages in core/updates_testing:
========================
lib(64)ecpg15_6-15.11-1.mga9
lib(64)pq5-15.11-1.mga9
postgresql15-15.11-1.mga9
postgresql15-contrib-15.11-1.mga9
postgresql15-devel-15.11-1.mga9
postgresql15-docs-15.11-1.mga9
postgresql15-pl-15.11-1.mga9
postgresql15-plperl-15.11-1.mga9
postgresql15-plpgsql-15.11-1.mga9
postgresql15-plpython3-15.11-1.mga9
postgresql15-pltcl-15.11-1.mga9
postgresql15-server-15.11-1.mga9

lib(64)ecpg13_6-13.19-1.mga9
lib(64)pq5.13-13.19-1.mga9
postgresql13-13.19-1.mga9
postgresql13-contrib-13.19-1.mga9
postgresql13-devel-13.19-1.mga9
postgresql13-docs-13.19-1.mga9
postgresql13-pl-13.19-1.mga9
postgresql13-plperl-13.19-1.mga9
postgresql13-plpgsql-13.19-1.mga9
postgresql13-plpython3-13.19-1.mga9
postgresql13-pltcl-13.19-1.mga9
postgresql13-server-13.19-1.mga9

from SRPMS:
postgresql15-15.11-1.mga9.src.rpm
postgresql13-13.19-1.mga9.src.rpm

Whiteboard: MGA9TOO => (none)
Status: NEW => ASSIGNED
Assignee: bugsquad => qa-bugs
Version: Cauldron => 9
Source RPM: postgresql17, postgresql15, postgresql13 => postgresql15, postgresql13

Comment 2 Herman Viaene 2025-02-14 15:30:07 CET
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
First installed version 13 ref bug 33779
# systemctl start postgresql
[root@mach3 ~]# systemctl -l status postgresql
● postgresql.service - PostgreSQL database server
     Loaded: loaded (/usr/lib/systemd/system/postgresql.service; disabled; preset: disabled)
     Active: active (running) since Fri 2025-02-14 15:12:14 CET; 14s ago
    Process: 43395 ExecStartPre=/usr/libexec/postgresql_initdb.sh ${PGDATA} (code=exited, status=0/SUCCESS)
    Process: 43400 ExecStart=/usr/bin/pg_ctl start -D ${PGDATA} -s -o -p ${PGPORT} -w -t 300 (code=exited, status=0/SUCCESS)
   Main PID: 43407 (postgres)
      Tasks: 7 (limit: 8806)
     Memory: 15.6M
        CPU: 190ms
     CGroup: /system.slice/postgresql.service
             ├─43407 /usr/bin/postgres -D /var/lib/pgsql/data -p 5432
             ├─43496 "postgres: checkpointer "
             ├─43497 "postgres: background writer "
             ├─43498 "postgres: walwriter "
             ├─43499 "postgres: autovacuum launcher "
             ├─43500 "postgres: stats collector "
             └─43501 "postgres: logical replication launcher "

Feb 14 15:12:13 mach3.hviaene.thuis systemd[1]: Starting postgresql.service...
Feb 14 15:12:14 mach3.hviaene.thuis pg_ctl[43407]: 2025-02-14 15:12:14.320 CET [43407] LOG:  starting PostgreSQL 13.19 on x86_64-mageia-linux-gnu, compiled >
Feb 14 15:12:14 mach3.hviaene.thuis pg_ctl[43407]: 2025-02-14 15:12:14.322 CET [43407] LOG:  listening on IPv6 address "::1", port 5432
Feb 14 15:12:14 mach3.hviaene.thuis pg_ctl[43407]: 2025-02-14 15:12:14.323 CET [43407] LOG:  listening on IPv4 address "127.0.0.1", port 5432
Feb 14 15:12:14 mach3.hviaene.thuis pg_ctl[43407]: 2025-02-14 15:12:14.367 CET [43407] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5432"
Feb 14 15:12:14 mach3.hviaene.thuis pg_ctl[43471]: 2025-02-14 15:12:14.525 CET [43471] LOG:  database system was shut down at 2025-01-24 17:25:55 CET
Feb 14 15:12:14 mach3.hviaene.thuis pg_ctl[43407]: 2025-02-14 15:12:14.708 CET [43407] LOG:  database system is ready to accept connections
[root@mach3 ~]# systemctl enable postgresql
Created symlink /etc/systemd/system/multi-user.target.wants/postgresql.service → /usr/lib/systemd/system/postgresql.service.
[root@mach3 ~]# systemctl restart postgresql
[root@mach3 ~]# systemctl -l status postgresql
● postgresql.service - PostgreSQL database server
     Loaded: loaded (/usr/lib/systemd/system/postgresql.service; enabled; preset: disabled)
     Active: active (running) since Fri 2025-02-14 15:13:18 CET; 14s ago
    Process: 51494 ExecStartPre=/usr/libexec/postgresql_initdb.sh ${PGDATA} (code=exited, status=0/SUCCESS)
    Process: 51505 ExecStart=/usr/bin/pg_ctl start -D ${PGDATA} -s -o -p ${PGPORT} -w -t 300 (code=exited, status=0/SUCCESS)
   Main PID: 51512 (postgres)
      Tasks: 7 (limit: 8806)
     Memory: 15.1M
        CPU: 183ms
     CGroup: /system.slice/postgresql.service
             ├─51512 /usr/bin/postgres -D /var/lib/pgsql/data -p 5432
             ├─51562 "postgres: checkpointer "
             ├─51564 "postgres: background writer "
             ├─51565 "postgres: walwriter "
             ├─51566 "postgres: autovacuum launcher "
             ├─51567 "postgres: stats collector "
             └─51568 "postgres: logical replication launcher "

Feb 14 15:13:18 mach3.hviaene.thuis systemd[1]: Starting postgresql.service...
Feb 14 15:13:18 mach3.hviaene.thuis pg_ctl[51512]: 2025-02-14 15:13:18.408 CET [51512] LOG:  starting PostgreSQL 13.19 on x86_64-mageia-linux-gnu, compiled >
Feb 14 15:13:18 mach3.hviaene.thuis pg_ctl[51512]: 2025-02-14 15:13:18.410 CET [51512] LOG:  listening on IPv6 address "::1", port 5432
Feb 14 15:13:18 mach3.hviaene.thuis pg_ctl[51512]: 2025-02-14 15:13:18.410 CET [51512] LOG:  listening on IPv4 address "127.0.0.1", port 5432
Feb 14 15:13:18 mach3.hviaene.thuis pg_ctl[51512]: 2025-02-14 15:13:18.485 CET [51512] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5432"
Feb 14 15:13:18 mach3.hviaene.thuis pg_ctl[51550]: 2025-02-14 15:13:18.601 CET [51550] LOG:  database system was shut down at 2025-02-14 15:13:17 CET
Feb 14 15:13:18 mach3.hviaene.thuis pg_ctl[51512]: 2025-02-14 15:13:18.671 CET [51512] LOG:  database system is ready to accept connections

Then used phppgadmin to create a new database, new table with PK, unique key, plain text and timestamp. Populated a few records, all OK.
Comong back for version 15.

CC: (none) => herman.viaene

Comment 3 Herman Viaene 2025-02-14 16:10:46 CET
# systemctl start postgresql
# systemctl -l status postgresql
● postgresql.service - PostgreSQL database server
     Loaded: loaded (/usr/lib/systemd/system/postgresql.service; disabled; preset: disabled)
     Active: active (running) since Fri 2025-02-14 15:49:06 CET; 4s ago
    Process: 158286 ExecStartPre=/usr/libexec/postgresql_initdb.sh ${PGDATA} (code=exited, status=0/SUCCESS)
    Process: 158300 ExecStart=/usr/bin/pg_ctl start -D ${PGDATA} -s -o -p ${PGPORT} -w -t 300 (code=exited, status=0/SUCCESS)
   Main PID: 158302 (postgres)
      Tasks: 6 (limit: 8806)
     Memory: 59.7M
        CPU: 3.708s
     CGroup: /system.slice/postgresql.service
             ├─158302 /usr/bin/postgres -D /var/lib/pgsql/data -p 5432
             ├─158303 "postgres: checkpointer "
             ├─158304 "postgres: background writer "
             ├─158306 "postgres: walwriter "
             ├─158307 "postgres: autovacuum launcher "
             └─158308 "postgres: logical replication launcher "

Feb 14 15:49:01 mach3.hviaene.thuis systemd[1]: Starting postgresql.service...
Feb 14 15:49:06 mach3.hviaene.thuis pg_ctl[158302]: 2025-02-14 15:49:06.639 CET [158302] LOG:  starting PostgreSQL 15.11 on x86_64-mageia-linux-gnu, compile>
Feb 14 15:49:06 mach3.hviaene.thuis pg_ctl[158302]: 2025-02-14 15:49:06.641 CET [158302] LOG:  listening on IPv6 address "::1", port 5432
Feb 14 15:49:06 mach3.hviaene.thuis pg_ctl[158302]: 2025-02-14 15:49:06.641 CET [158302] LOG:  listening on IPv4 address "127.0.0.1", port 5432
Feb 14 15:49:06 mach3.hviaene.thuis pg_ctl[158302]: 2025-02-14 15:49:06.674 CET [158302] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5432"
Feb 14 15:49:06 mach3.hviaene.thuis pg_ctl[158305]: 2025-02-14 15:49:06.750 CET [158305] LOG:  database system was shut down at 2025-02-14 15:49:05 CET
Feb 14 15:49:06 mach3.hviaene.thuis pg_ctl[158302]: 2025-02-14 15:49:06.843 CET [158302] LOG:  database system is ready to accept connections
Feb 14 15:49:06 mach3.hviaene.thuis systemd[1]: Started postgresql.service.
# systemctl enable postgresql
Created symlink /etc/systemd/system/multi-user.target.wants/postgresql.service → /usr/lib/systemd/system/postgresql.service.
# systemctl restart postgresql
# systemctl -l status postgresql
● postgresql.service - PostgreSQL database server
     Loaded: loaded (/usr/lib/systemd/system/postgresql.service; enabled; preset: disabled)
     Active: active (running) since Fri 2025-02-14 15:49:40 CET; 10s ago
    Process: 158375 ExecStartPre=/usr/libexec/postgresql_initdb.sh ${PGDATA} (code=exited, status=0/SUCCESS)
    Process: 158376 ExecStart=/usr/bin/pg_ctl start -D ${PGDATA} -s -o -p ${PGPORT} -w -t 300 (code=exited, status=0/SUCCESS)
   Main PID: 158378 (postgres)
      Tasks: 6 (limit: 8806)
     Memory: 15.7M
        CPU: 174ms
     CGroup: /system.slice/postgresql.service
             ├─158378 /usr/bin/postgres -D /var/lib/pgsql/data -p 5432
             ├─158379 "postgres: checkpointer "
             ├─158380 "postgres: background writer "
             ├─158382 "postgres: walwriter "
             ├─158383 "postgres: autovacuum launcher "
             └─158384 "postgres: logical replication launcher "

Feb 14 15:49:39 mach3.hviaene.thuis systemd[1]: Starting postgresql.service...
Feb 14 15:49:39 mach3.hviaene.thuis pg_ctl[158378]: 2025-02-14 15:49:39.979 CET [158378] LOG:  starting PostgreSQL 15.11 on x86_64-mageia-linux-gnu, compile>
Feb 14 15:49:39 mach3.hviaene.thuis pg_ctl[158378]: 2025-02-14 15:49:39.980 CET [158378] LOG:  listening on IPv6 address "::1", port 5432
Feb 14 15:49:39 mach3.hviaene.thuis pg_ctl[158378]: 2025-02-14 15:49:39.980 CET [158378] LOG:  listening on IPv4 address "127.0.0.1", port 5432
Feb 14 15:49:40 mach3.hviaene.thuis pg_ctl[158378]: 2025-02-14 15:49:40.027 CET [158378] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5432"
Feb 14 15:49:40 mach3.hviaene.thuis pg_ctl[158381]: 2025-02-14 15:49:40.099 CET [158381] LOG:  database system was shut down at 2025-02-14 15:49:39 CET
Feb 14 15:49:40 mach3.hviaene.thuis pg_ctl[158378]: 2025-02-14 15:49:40.168 CET [158378] LOG:  database system is ready to accept connections
Feb 14 15:49:40 mach3.hviaene.thuis systemd[1]: Started postgresql.service.

phppgadmin does not work for postgres15
So manual operations as in bug 33779.
$ psql -U postgres
psql (13.19)
Type "help" for help.

postgres=# exit
[tester9@mach3 ~]$ psql -U postgres
psql (15.11)
Type "help" for help.

postgres=# create database testpg1511;
CREATE DATABASE
postgres=# \c testpg1511;
You are now connected to database "testpg1511" as user "postgres".
testpg1511=# create table mag_versions (name varchar(12), cr_date date);
CREATE TABLE
testpg1511=# create index magidx on mag_versions(name);
CREATE INDEX
testpg1511=# insert into mag_versions values ('10', '25-Mar-2025');
INSERT 0 1
testpg1511=# insert into mag_versions values ('8', '2-Feb-2021');
INSERT 0 1
testpg1511=# insert into mag_versions values ('9', '26-Aug-2023');
INSERT 0 1
testpg1511=# select * from mag_versions;
 name |  cr_date   
------+------------
 10   | 2025-03-25
 8    | 2021-02-02
 9    | 2023-08-26
(3 rows)

testpg1511=# delete from mag_versions where name = '10';
DELETE 1
testpg1511=# select * from mag_versions;
 name |  cr_date   
------+------------
 8    | 2021-02-02
 9    | 2023-08-26
(2 rows)

testpg1511=# quit

Looks good

Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2025-02-14 16:36:13 CET
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

katnatek 2025-02-14 18:08:50 CET

Keywords: (none) => advisory

Comment 5 Mageia Robot 2025-02-14 21:37:12 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0064.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.