Red Hat Product Security has issued an important security advisory (RHSA-2025:15114) for PostgreSQL included in Red Hat Enterprise Linux 9.4 Extended Update Support and related products. The advisory addresses three CVEs (CVE-2025-8713, CVE-2025-8714, CVE-2025-8715) involving arbitrary code execution vulnerabilities during PostgreSQL restore operations. These vulnerabilities could allow code execution if a specially crafted restore operation is performed. The advisory provides updated PostgreSQL packages (version 13.22-1.el9_4) that fix these issues. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat. No known exploits in the wild have been reported at this time.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on the affected system during a PostgreSQL restore operation. This could lead to full compromise of the database server and potentially the underlying host system. The vulnerabilities affect PostgreSQL installations on Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. No evidence of active exploitation is currently known.

Red Hat has released updated PostgreSQL packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support and related products should apply the available security updates as described in the Red Hat advisory RHSA-2025:15114 and the associated article https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. There is no indication that additional mitigations are required beyond applying the official patches.