Re: CVE-2025-1094: PostgreSQL: Quoting APIs miss neutralizing quoting syntax in text that fails encoding validation, enabling psql SQL injection

[James Addison <james () reciperadar com>]

On Sun, Feb 16, 2025 at 4:22 PM Solar Designer <solar () openwall com> wrote:
> Hi,
>
> As announced on February 13 in:
>
> https://www.postgresql.org/about/news/postgresql-173-167-1511-1416-and-1319-released-3015/
> https://www.postgresql.org/message-id/173945575457.197393.6175786842655230205%40wrigleys.postgresql.org
>
> > The PostgreSQL Global Development Group has released an update to all supported
> > versions of PostgreSQL, including 17.3, 16.7, 15.11, 14.16, and 13.19.
> > This release fixes 1 security vulnerability and over 70 bugs reported over the
> > last several months.
> > [ ... snip ... ]

For anyone considering upgrading: please note also that the fix for
this vulnerability introduced a regression[1] that should be addressed
by subsequent upcoming releases of PostgreSQL on Thursday 2025-02-20
(a few days from now).

[1] - https://www.postgresql.org/message-id/272abbd9-d24c-49f1-8b61-83721906aa3b () postgresql org