PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs.
Most of those code execution bugs are memory errors or type confusion, where PostgreSQL handles a value as the wrong data type. They turn up in PL/Perl and PL/Tcl, text search functions such as ts_rank_cd(), parallel query, logical replication, dblink and statistics import. Thirty-two of the 52 CVEs carry a CVSS score of 8.8, the highest in the batch. The lowest, a way around the EXECUTE privilege on cast functions, scores 3.1.
The fixes also reach PostgreSQL’s client tools. The pg_dump utility had a SQL injection through not-null constraint names, and its tar-format restore script failed to block psql command injection. The reindexdb tool mishandled quoting of index names. If you run these tools against databases where other users can create and name objects, update the client binaries along with the server.
Some fixes need a reindex
Several bug fixes require work after the new binaries are in place. GIN indexes suspected of corruption should be reindexed. So should pg_trgm GiST indexes that use gist_trgm_ops, and B-tree indexes on bpchar columns declared without a length. Tables that throw “missing chunk number” errors need REINDEX TABLE. Administrators using incremental backups should take a new full backup and base later incrementals on it, because several of the fixed bugs could produce corrupt backups.
PostgreSQL 14 is done
Version 14.25 is the final release of PostgreSQL 14, which gets no further security or bug fixes. Servers still running it need a plan to move to a supported version.
The project also shipped PostgreSQL 19 RC 2, with general availability planned for November 19. Anyone who tested 19 should know that RC 2 reverts support for JSON_ARRAY() and JSON_OBJECT() over arrays, composite types and range types in expression indexes, generated columns and partition keys. Objects built that way have to be dropped or redefined before upgrading.
