ALAS2023-2025-1314

References: CVE-2025-12817  CVE-2025-12818 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12817)

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12818)

Issue Correction:
Run dnf update postgresql16 --releasever 2023.9.20251208 or dnf update --advisory ALAS2023-2025-1314 --releasever 2023.9.20251208 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    postgresql16-llvmjit-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-plpython3-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-upgrade-devel-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-docs-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-server-devel-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-static-16.11-1.amzn2023.0.1.aarch64
    postgresql16-private-libs-16.11-1.amzn2023.0.1.aarch64
    postgresql16-pltcl-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-private-libs-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-16.11-1.amzn2023.0.1.aarch64
    postgresql16-pltcl-16.11-1.amzn2023.0.1.aarch64
    postgresql16-server-16.11-1.amzn2023.0.1.aarch64
    postgresql16-plperl-16.11-1.amzn2023.0.1.aarch64
    postgresql16-plpython3-16.11-1.amzn2023.0.1.aarch64
    postgresql16-server-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-test-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-upgrade-16.11-1.amzn2023.0.1.aarch64
    postgresql16-test-16.11-1.amzn2023.0.1.aarch64
    postgresql16-llvmjit-16.11-1.amzn2023.0.1.aarch64
    postgresql16-upgrade-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-server-devel-16.11-1.amzn2023.0.1.aarch64
    postgresql16-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-private-devel-16.11-1.amzn2023.0.1.aarch64
    postgresql16-contrib-16.11-1.amzn2023.0.1.aarch64
    postgresql16-contrib-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-docs-16.11-1.amzn2023.0.1.aarch64
    postgresql16-plperl-debuginfo-16.11-1.amzn2023.0.1.aarch64
    postgresql16-upgrade-devel-16.11-1.amzn2023.0.1.aarch64
    postgresql16-debugsource-16.11-1.amzn2023.0.1.aarch64

noarch:
    postgresql16-test-rpm-macros-16.11-1.amzn2023.0.1.noarch

src:
    postgresql16-16.11-1.amzn2023.0.1.src

x86_64:
    postgresql16-upgrade-devel-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-plpython3-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-private-libs-16.11-1.amzn2023.0.1.x86_64
    postgresql16-server-devel-16.11-1.amzn2023.0.1.x86_64
    postgresql16-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-server-devel-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-test-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-docs-16.11-1.amzn2023.0.1.x86_64
    postgresql16-private-devel-16.11-1.amzn2023.0.1.x86_64
    postgresql16-static-16.11-1.amzn2023.0.1.x86_64
    postgresql16-upgrade-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-docs-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-llvmjit-16.11-1.amzn2023.0.1.x86_64
    postgresql16-contrib-16.11-1.amzn2023.0.1.x86_64
    postgresql16-plperl-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-private-libs-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-pltcl-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-llvmjit-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-contrib-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-upgrade-16.11-1.amzn2023.0.1.x86_64
    postgresql16-server-debuginfo-16.11-1.amzn2023.0.1.x86_64
    postgresql16-plperl-16.11-1.amzn2023.0.1.x86_64
    postgresql16-plpython3-16.11-1.amzn2023.0.1.x86_64
    postgresql16-pltcl-16.11-1.amzn2023.0.1.x86_64
    postgresql16-test-16.11-1.amzn2023.0.1.x86_64
    postgresql16-server-16.11-1.amzn2023.0.1.x86_64
    postgresql16-16.11-1.amzn2023.0.1.x86_64
    postgresql16-debugsource-16.11-1.amzn2023.0.1.x86_64
    postgresql16-upgrade-devel-16.11-1.amzn2023.0.1.x86_64