CVE-2025-1094
HighAdvisory
Published 13 Feb 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.1
- base score, highest
- EPSS
- 0.900
- 100th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 243
- of 17,781 indexed, latest versions
- Container images
- 250
- deployed by those charts
- Fix available
- 13 of 15
- affected packages
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
Carried by container images the latest versions of 243 of 17,781 indexed charts deploy, on 250 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| postgresql-15deb | 15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+5 more | 15.11-0+deb12u1 | 72 |
| postgresqlbitnami | 11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+19 more | 13.19.0 | 24 |
| postgresql-12deb | 12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 more | 12.22-0ubuntu0.20.04.2 | 17 |
| postgresql16apk | 16.1-r0, 16.2-r0, 16.2-r1, 16.3-r0+2 more | 16.8-r0 | 13 |
| PostgreSQLbitnami | 15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more | 13.19.0 | 11 |
| postgresql-14deb | 14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+3 more | 14.17-0ubuntu0.22.04.1 | 10 |
| postgresql15apk | 15.3-r0, 15.4-r0, 15.5-r0, 15.6-r0+1 more | 15.11-r0 | 8 |
| postgresql-10deb | 10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 more | 10.23-0ubuntu0.18.04.2+esm3 | 6 |
| libpqrpm | 12.4-1.el8_2, 13.3-1.el8_4, 13.5-1.el9, 13.11-1.el9 | 0:12.7-1.el8_2.2, 0:13.20-1.el8_4, 0:13.20-1.el9_4, 0:13.20-1.el9_5 | 5 |
| postgresqlrpm | 9.2.24-1.el7_5, 13.23-1.el9_7, 15.18-1.module+el9.8.0+40219+bc9dfb23 | 0:9.2.24-9.el7_9.3, 0:15.12-1.module+el9.5.0+22866+495a739a, 0:16.8-1.module+el9.5.0+30638+72f697e1 | 4 |
| postgresql-9.5deb | 9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04 | no fix listed | 3 |
| postgresql-16deb | 16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1 | 16.8-0ubuntu0.24.04.1 | 2 |
| postgresql17apk | 17.2-r0 | 17.4-r0 | 2 |
| postgresql-9.3deb | 9.3.22-0ubuntu0.14.04 | no fix listed | 1 |
| postgresql-13deb | 13.3-1, 13.4-0+deb11u1, 13.5-0+deb11u1, 13.6-1.pgdg110+1+12 more | 13.19-0+deb11u1 | 82 |
- OSV records
- ALPINE-CVE-2025-1094BIT-postgresql-2025-1094DEBIAN-CVE-2025-1094RHSA-2025:1720RHSA-2025:1732RHSA-2025:1735RHSA-2025:1738RHSA-2025:1741RHSA-2025:3978RLSA-2025:1743UBUNTU-CVE-2025-1094DLA-4052-1
- Also known as
- DLA-4052-2, RHSA-2025:1737, RHSA-2025:1743, USN-7315-1, USN-7315-2
Charts affected
243 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| airflowapache-airflowOfficialVerified publisher | 1.22.0 | 1 of 4See more | 3,195 |
| airflowairflow-helmVerified publisher | 8.9.0 | 2 of 4See more | 11,367 |
| netboxbootcVerified publisher | 4.1.1 | 1 of 4See more | 9,145 |
| difydoubanVerified publisher | 0.10.0 | 1 of 6See more | 19,391 |
| difydify-helmVerified publisher | 0.38.0 | 1 of 11See more | 22,002 |
| openprojectopenproject-helm-chartsOfficialVerified publisher | 13.11.0 | 1 of 5See more | 19,926 |
| zabbixcetic | 3.1.3 | 2 of 5See more | 33,725 |
| chatwootchatwootVerified publisher | 2.0.24 | 1 of 3See more | 9,203 |
| synapsehalkeye | 0.40.0 | 1 of 2See more | 6,543 |
| stacks-blockchain-apihirosystemsVerified publisher | 6.5.1 | 1 of 5See more | 8,364 |
| litellm-helmlitellm | 1.100.1 | 1 of 2See more | 5,003 |
| flagsmithflagsmithOfficialVerified publisher | 0.83.0 | 1 of 4See more | 2,110 |
| prefect-serverprefectVerified publisher | 2026.9.3212605 | 1 of 2See more | 5,786 |
| adminercetic | 0.2.1 | 1 of 1See more | 461 |
| ilumilumOfficialVerified publisher | 6.7.3 | 2 of 19See more | 23,228 |
| tbmq-clustertbmq-helm-chartOfficialVerified publisher | 2.1.0 | 1 of 3See more | 3,534 |
| barmanadfinisVerified publisher | 0.10.0 | 1 of 1See more | 1,552 |
| zabbix-serveraekondratievVerified publisher | 1.0.6 | 2 of 4See more | 30,668 |
| baserowbaserow-chartVerified publisher | 1.0.56 | 1 of 6See more | 17,263 |
| fadicetic | 0.3.1 | 1 of 25See more | 52,919 |
| daskhubdask | 2024.1.1 | 1 of 9See more | 14,094 |
| infrahubinfrahubVerified publisher | 4.33.2 | 1 of 5See more | 10,428 |
| kubeflowkubeflow | 1.6.2 | 2 of 45See more | 96,941 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 1 of 6See more | 10,530 |
| librechatlibrechat-openshiftVerified publisher | 1.9.0 | 1 of 3See more | 5,779 |
| k8s-telegram-sendertelegram-senderVerified publisher | 0.0.1 | 1 of 1See more | 3,048 |
| uffizzi-appuffizzi-app | 1.3.0 | 1 of 14See more | 19,337 |
| alerta-webalerta-webVerified publisher | 0.1.12 | 1 of 2See more | 3,569 |
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 1 of 5See more | 17,404 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 1 of 10See more | 28,839 |
| infrahub-enterpriseinfrahub-enterpriseVerified publisher | 4.19.2 | 1 of 5See more | 10,530 |
| kea-dhcpmglants | 0.7.1 | 1 of 1See more | 1,133 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 18,517 |
| open-zaakopen-zaak | 0.8.0 | 1 of 3See more | 4,045 |
| nominatimrobjuz | 6.4.1 | 1 of 4See more | 8,690 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,566 |
| feedbacksystemthm-mni-iiVerified publisher | 0.47.1 | 1 of 10See more | 28,534 |
| huginnutkuozdemirVerified publisher | 2.2.1 | 1 of 4See more | 18,137 |
| roundcubevolker-raschekVerified publisher | 0.3.1 | 1 of 1See more | 1,797 |
| wombatwombatOfficialVerified publisher | 4.1.28 | 1 of 1See more | 3,697 |
| clearml-servingallegroaiVerified publisher | 1.6.2 | 2 of 9See more | 17,877 |
| psonoankra-chartsVerified publisher | 1.2.0 | 1 of 2See more | 2,388 |
| open-elevationbeeinventor | 0.1.0 | 1 of 2See more | 13,145 |
| paperless-ngxcrystalnetVerified publisher | 0.2.22 | 1 of 3See more | 13,761 |
| mastodondefault-ghVerified publisher | 0.3.1 | 1 of 3See more | 5,056 |
| frontenddemo-application | 0.1.0 | 1 of 1See more | 3,558 |
| pgbouncerestaidVerified publisher | 1.0.7 | 1 of 1See more | 544 |
| obicogabe565Verified publisher | 0.6.0 | 1 of 3See more | 1,965 |
| deepstackgeek-cookbookVerified publisher | 1.5.2 | 1 of 2See more | 5,305 |
| paperlessgeek-cookbookVerified publisher | 9.2.0 | 1 of 1See more | 3,924 |
Container images carrying it
250 by charts deploying them
A fixed version is listed for 13 of the 15 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 8775adb39f0d | postgresql-15 | 15.11-0+deb12u1 | 1 |
| library/ | d41127070014 | postgresql-15 | 15.11-0+deb12u1 | 1 |
| librenms/ | 0920bc9117a8 | postgresql16 | 16.8-r0 | 1 |
| lsstsqre/ | b75bf8aaafa4 | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| maissacrement/ | 6da0db1159da | postgresql-13 | 13.19-0+deb11u1 | 1 |
| matrixdotorg/ | cb89c0f17ba1 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| matrixdotorg/ | def97fd537d8 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| matterlabs/ | 5dadc06bdf3b | postgresql-15 | 15.11-0+deb12u1 | 1 |
| matterlabs/ | 6cbfea4c694a | postgresql-15 | 15.11-0+deb12u1 | 1 |
| mediagis/ | c15e941485ef | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| mediagis/ | d0eae7b51374 | postgresql-14 | 14.17-0ubuntu0.22.04.1 | 1 |
| mnaggar3396/ | 371d8ed84b15 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| moreillon/ | bacb2ddd8394 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| moreillon/ | d2ee0423b797 | postgresql-15 | 15.11-0+deb12u1 | 1 |
| muhammedgamal/ | 74b4cd69b6fa | postgresql-15 | 15.11-0+deb12u1 | 1 |
| nathanielvarona/ | b746a34e5597 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| netboxcommunity/ | 3d652dca5351 | postgresql-14 | 14.17-0ubuntu0.22.04.1 | 1 |
| omecproject/ | d109a8e57e71 | postgresql-9.5 | no fix listed | 1 |
| opea/ | 2bee4eb66f3e | postgresql-15 | 15.11-0+deb12u1 | 1 |
| opea/ | 3ef121f34610 | postgresql-15 | 15.11-0+deb12u1 | 1 |
| opea/ | 7f854e9bffaf | postgresql-15 | 15.11-0+deb12u1 | 1 |
| opendatacube/ | 5d810e8504b8 | postgresql-10 | 10.23-0ubuntu0.18.04.2+esm3 | 1 |
| opendatacube/ | 91870111837c | postgresql-10 | 10.23-0ubuntu0.18.04.2+esm3 | 1 |
| opendatacube/ | 1b90cdf68831 | postgresql-10 | 10.23-0ubuntu0.18.04.2+esm3 | 1 |
| openelevation/ | 82fb21612e86 | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| openkm/ | 3bc465a7461b | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| openzaak/ | 2e65313b9b10 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| openzaak/ | 2ca2ea6e0ae9 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| owncloud/ | 51d9b74fc2a8 | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| oxfordsemantic/ | db17910eb855 | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| oxfordsemantic/ | baf570ff968d | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| pecan/ | 814d678c5550 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| phntom/ | d8e2a9f2f085 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| phntom/ | 3adadbac8443 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| pschiffe/ | 37ebba8c2b8f | postgresql | 0:16.8-1.module+el9.5.0+30638+72f697e1 | 1 |
| psono/ | 3b974b43ea03 | postgresql16 | 16.8-r0 | 1 |
| ptthanh1511/ | 5741cbde85ab | postgresql-12 | 12.22-0ubuntu0.20.04.2 | 1 |
| reportportal/ | 2a0e6dc11161 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| robjuz/ | 805c7bab76df | postgresql | 13.19.0 | 1 |
| robmarkcole/ | 410275726459 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| robotshop/ | 774b52c6180d | postgresql-13 | 13.19-0+deb11u1 | 1 |
| roundcube/ | a8ea6fd751dc | postgresql-13 | 13.19-0+deb11u1 | 1 |
| sashafefler/ | f96d7804c0ca | postgresql-15 | 15.11-0+deb12u1 | 1 |
| seldonio/ | 4e985d2006a8 | libpq | 0:13.20-1.el8_4 | 1 |
| sissbruecker/ | 0c5dddf0b37c | postgresql-15 | 15.11-0+deb12u1 | 1 |
| socialmediamacroscope/ | 4fb86885d64d | postgresql-13 | 13.19-0+deb11u1 | 1 |
| socialmediamacroscope/ | 4bfda60829fe | postgresql-13 | 13.19-0+deb11u1 | 1 |
| socialmediamacroscope/ | 07477060bba8 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| socialmediamacroscope/ | c969f7677983 | postgresql-13 | 13.19-0+deb11u1 | 1 |
| socialmediamacroscope/ | 9b4211832429 | postgresql-13 | 13.19-0+deb11u1 | 1 |