PostgreSQL November update fixes 52 flaws and ends version 14 support
Original title: PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
Thirty-two of the 52 flaws are scored CVSS 8.8, and 14.25 is the final PostgreSQL 14 release.
The PostgreSQL Global Development Group released 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs. Many code-execution issues are memory errors or type confusion in procedural languages, text search, replication and tools such as pg_dump. Some fixes require reindexing and a new full backup. Version 14 gets no further security fixes.
- The lowest score in the batch, an EXECUTE privilege bypass on casts, is 3.1.
- pg_dump allowed SQL injection through not-null constraint names and a tar-format restore script flaw.
- Suspect GIN indexes, gist_trgm_ops GiST indexes and some bpchar B-trees need REINDEX.
- PostgreSQL 19 RC 2 drops some JSON expression-index support before the November 19 release.
Impact: Code execution via memory errors or type confusion
| Product | Affected | Fixed in |
|---|---|---|
| PostgreSQL Global Development Group PostgreSQL | — | 18.7, 17.12, 16.16, 15.20 and 14.25 |
- 1.Install the November 12 server and client binaries, including pg_dump and reindexdb.
- 2.Reindex affected GIN, pg_trgm GiST and bpchar B-tree indexes after upgrading.
- 3.Take a new full backup before basing later incremental backups on it.
- Products
- PostgreSQLpg_dumpreindexdb
From the original article
1 min read at helpnetsecurity.com
The PostgreSQL Global Development Group released PostgreSQL 18. 7, 17. 12, 16.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.