[osgeo4w-dev] [osgeo4w] #929: Vulnerable Postgresql 18.4 components included with OSGEO4W install

[OSGeo4W]

#929: Vulnerable Postgresql 18.4 components included with OSGEO4W install
----------------------+---------------------------
Reporter:  ascottwwf  |      Owner:  osgeo4w-dev@…
    Type:  defect     |     Status:  new
Priority:  normal     |  Component:  Package
 Version:             |   Keywords:
----------------------+---------------------------
 Hello,

 I have become aware that our QGIS LTR installations v3.44.13 contain
 Postgresql v18.4 components (we use the OSGeo4W installer to install /
 maintain QGIS LTR onto our devices),

 Postgresql 18.4 contains 24 published Security vulnerabilities (CVEs), a
 list of these which affect v18.0 and later can be found here:
 https://www.postgresql.org/support/security/18/

 These flaws carry CVSS v3 scores of between 3.8 (Low) and 8.8 (High)

 The affected files are all found in our default installation folder
 "C:\Program Files\OSGeo4W_v2\bin"

 Evidence of the affected files (using Powershell):

 {{{
 cd "C:\Program Files\OSGeo4W_v2\bin\"
 Get-ChildItem libpq.dll,*pg_*.exe -Recurse -Force -ErrorAction
 SilentlyContinue | Select-Object * -ExpandProperty versioninfo | Sort-
 Object ProductVersion,FileVersionRaw,Filename | Select-Object
 ProductVersion,FileVersionRaw,Filename,FileDescription,CompanyName,LegalCopyright
 | fl

 ProductVersion  : 18.4
 FileVersionRaw  : 18.0.4.0
 FileName        : C:\Program Files\OSGeo4W_v2\bin\libpq.dll
 FileDescription : PostgreSQL Access Library
 CompanyName     : PostgreSQL Global Development Group
 LegalCopyright  : Portions Copyright (c) 1996-2025, PostgreSQL Global
 Development Group. Portions Copyright (c) 1994, Regents of the University
 of California.

 ProductVersion  : 18.4
 FileVersionRaw  : 18.0.4.0
 FileName        : C:\Program Files\OSGeo4W_v2\bin\pg_dump.exe
 FileDescription : pg_dump - backup one PostgreSQL database
 CompanyName     : PostgreSQL Global Development Group
 LegalCopyright  : Portions Copyright (c) 1996-2025, PostgreSQL Global
 Development Group. Portions Copyright (c) 1994, Regents of the University
 of California.

 ProductVersion  : 18.4
 FileVersionRaw  : 18.0.4.0
 FileName        : C:\Program Files\OSGeo4W_v2\bin\pg_dumpall.exe
 FileDescription : pg_dumpall - backup PostgreSQL databases
 CompanyName     : PostgreSQL Global Development Group
 LegalCopyright  : Portions Copyright (c) 1996-2025, PostgreSQL Global
 Development Group. Portions Copyright (c) 1994, Regents of the University
 of California.

 ProductVersion  : 18.4
 FileVersionRaw  : 18.0.4.0
 FileName        : C:\Program Files\OSGeo4W_v2\bin\pg_restore.exe
 FileDescription : pg_restore - restore PostgreSQL databases
 CompanyName     : PostgreSQL Global Development Group
 LegalCopyright  : Portions Copyright (c) 1996-2025, PostgreSQL Global
 Development Group. Portions Copyright (c) 1994, Regents of the University
 of California.

 }}}

 Please can I request that the Postgresql components included with OSGeo4W
 Installer be updated to a later version without impacting / breaking other
 dependencies (suggest 18.6 - Release Notes:
 https://www.postgresql.org/docs/release/18.6/)

 Thanks in advance,

 Regards,\\

 Adrian Scott | EUC Specialist, WWF-UK\\

 WWF-UK, The Living Planet Centre, Rufford House,\\

 Brewery Road, Woking, Surrey GU21 4LL | wwf.org.uk
-- 
Ticket URL: <https://trac.osgeo.org/osgeo4w/ticket/929>
OSGeo4W <http://trac.osgeo.org/osgeo4w>
OSGeo4W is the Windows installer and package environment for the OSGeo stack.