This advisory addresses three related vulnerabilities in PostgreSQL, specifically CVE-2025-8713, CVE-2025-8714, and CVE-2025-8715, which involve the execution of arbitrary code during restore operations. The vulnerabilities are rated as important by Red Hat Product Security. The update fixes these issues in PostgreSQL version 13.22-1.el9_4 for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. The advisory references bugzilla entries BZ-2388551 and BZ-2388553 for the fixes of CVE-2025-8715 and CVE-2025-8714 respectively. No CVSS scores are provided in the advisory, but the severity is considered high.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code during the PostgreSQL restore operation, potentially compromising the database server. This could lead to unauthorized access or control over the affected system. The vulnerabilities affect PostgreSQL running on Red Hat Enterprise Linux 9.4 Extended Update Support and related variants across multiple architectures.

Red Hat has released updated PostgreSQL packages (version 13.22-1.el9_4) that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support versions should apply the security update as detailed in Red Hat advisory RHSA-2025:15114 and the referenced article https://access.redhat.com/articles/11258. Applying the official update is the recommended mitigation. Patch status is confirmed as fixed in the updated packages.