Red Hat Product Security issued an important security update for the postgresql:15 module in Red Hat Enterprise Linux 8.8 to address multiple vulnerabilities (CVE-2025-8713, CVE-2025-8714, CVE-2025-8715) that allow arbitrary code execution during restore operations. These vulnerabilities affect PostgreSQL as distributed in Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. The advisory references fixes included in updated packages (e.g., postgresql-15.14-1) and provides links for applying the update. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat.

The vulnerabilities allow an attacker to execute arbitrary code during the restore operation of PostgreSQL databases. This could lead to unauthorized code execution on affected systems running vulnerable PostgreSQL versions, potentially compromising the confidentiality, integrity, and availability of the database and host system.

Red Hat has released updated PostgreSQL 15 packages that address these vulnerabilities. Users should apply the security update for postgresql:15 as provided in Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. Refer to Red Hat's official article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated by the vendor advisory.