FEDORA-2026-5b2e6bf881 — security update for postgresql16

stable

postgresql16-16.14-1.fc45

FEDORA-2026-5b2e6bf881 created by packit 3 months ago for Fedora 45

Automatic update for postgresql16-16.14-1.fc45.

Changelog

* Thu Jul 23 2026 Petr Khartskhaev <pkhartsk@redhat.com> - 16.14-1
- Update to version 16.14
- Resolves: rhbz#2477451
- Resolves: rhbz#2499964
- Resolves: rhbz#2499726
- Resolves: rhbz#2499705
- Resolves: rhbz#2489304
- Resolves: rhbz#2487460
- Resolves: rhbz#2484513
- Resolves: rhbz#2484512
- Resolves: rhbz#2484431
- Resolves: rhbz#2482515
- Resolves: rhbz#2499705
* Wed Jul 22 2026 Python Maint <python-maint@redhat.com> - 16.13-7
- Rebuilt for Python 3.15.0b4 ABI change

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-5b2e6bf881

This update was automatically created

3 months ago

This update's test gating status has been changed to 'ignored'.

3 months ago

This update has been submitted for stable by bodhi

3 months ago

Please log in to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

0 days

Dates

submitted

3 months ago

in testing

3 months ago

in stable

3 months ago

approved

3 months ago

Builds

postgresql16-16.14-1.fc45

BZ#2477451 postgresql16-16.14 is available

BZ#2482515 CVE-2026-6478 postgresql16: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison [fedora-all]

BZ#2484431 CVE-2026-6473 postgresql16: integer overflow can cause an undersized allocation and an out-of-bounds write [fedora-all]

BZ#2484512 CVE-2026-6475 postgresql16: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind [fedora-all]

BZ#2484513 CVE-2026-6477 postgresql16: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory [fedora-all]

BZ#2487460 CVE-2026-6575 postgresql16: PostgreSQL: Information disclosure via buffer over-read in pg_restore_attribute_stats() [fedora-all]

BZ#2489304 CVE-2026-6472 postgresql16: PostgreSQL: Arbitrary code execution via missing authorization in CREATE TYPE [fedora-all]

BZ#2499705 CVE-2026-6479 postgresql16: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation [fedora-all]

BZ#2499726 CVE-2026-6637 postgresql16: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module [fedora-all]

BZ#2499964 CVE-2026-6638 postgresql16: PostgreSQL: Arbitrary SQL execution via SQL injection in logical replication [fedora-all]

postgresql16-16.14-1.fc45

Automated Test Results

ignored