SB2025090534 - Anolis OS update for postgresql:13 module

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2025-8714)

The vulnerability allows a remote user to execute arbitrary psql code on the target system.

The vulnerability exists due to improper input validation in pg_dump. A malicious superuser of the origin server to inject arbitrary psql code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands, such as pg_dump, pg_dumpall, and pg_restore.

2) Improper input validation (CVE-ID: CVE-2024-21096)

The vulnerability allows a local non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Client: mysqldump component in MySQL Server. A local non-authenticated attacker can exploit this vulnerability to read and manipulate data.

3) Input validation error (CVE-ID: CVE-2025-8715)

The vulnerability allows a remote user to execute arbitrary psql code.

The vulnerability exists in pg_dump due to insufficient validation of user-supplied input when handling new line characters. A remote attacker can trick the victim into loading a specially crafted backup and execute arbitrary psql code on the system.

4) SQL injection (CVE-ID: CVE-2012-0868)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2025:0616