Red Hat Product Security published an advisory (RHSA-2025:15034) addressing two vulnerabilities in PostgreSQL 12 that allow arbitrary code execution during the restore operation (CVE-2025-8714 and CVE-2025-8715). These vulnerabilities are rated as important by Red Hat and affect PostgreSQL running on Red Hat Enterprise Linux 8.4. The advisory provides updated packages to fix these issues. No CVSS score is provided in the advisory, but the impact involves execution of arbitrary code, which is a serious security concern. The advisory references fixes in the postgresql:12 module packages and directs users to apply the update as described in Red Hat's documentation.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code during the database restore operation, potentially compromising the affected system. This could lead to unauthorized control over the PostgreSQL server environment. The advisory classifies the impact as important, indicating a high risk to affected systems if unpatched.

Red Hat has released updated packages for the postgresql:12 module on Red Hat Enterprise Linux 8.4 that address these vulnerabilities. Users should apply the security update as detailed in Red Hat's advisory and documentation (https://access.redhat.com/articles/11258). Since this is a traditional software package and not a cloud service, remediation requires applying the vendor-provided update. Patch status is confirmed by the vendor advisory.