Bug 2387083 (CVE-2025-47907) - CVE-2025-47907 database/sql: Postgres Scan Race Condition
Summary: CVE-2025-47907 database/sql: Postgres Scan Race Condition
Keywords:
Status: NEW
Alias: CVE-2025-47907
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2397303 2397304 2397301 2397302 2397305
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-08-07 16:01 UTC by OSIDB Bzimport
Modified: 2025-11-25 02:09 UTC (History)
149 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:19397 0 None None None 2025-11-03 01:37:25 UTC
Red Hat Product Errata RHSA-2025:19731 0 None None None 2025-11-04 19:45:52 UTC
Red Hat Product Errata RHSA-2025:20909 0 None None None 2025-11-11 13:49:06 UTC
Red Hat Product Errata RHSA-2025:20983 0 None None None 2025-11-11 19:10:07 UTC
Red Hat Product Errata RHSA-2025:21148 0 None None None 2025-11-25 02:09:20 UTC
Red Hat Product Errata RHSA-2025:21336 0 None None None 2025-11-13 15:13:39 UTC
Red Hat Product Errata RHSA-2025:21337 0 None None None 2025-11-13 15:16:22 UTC
Red Hat Product Errata RHSA-2025:21382 0 None None None 2025-11-13 18:53:36 UTC
Red Hat Product Errata RHSA-2025:21383 0 None None None 2025-11-13 18:49:10 UTC
Red Hat Product Errata RHSA-2025:21384 0 None None None 2025-11-13 18:54:04 UTC
Red Hat Product Errata RHSA-2025:21385 0 None None None 2025-11-13 18:52:56 UTC

Description OSIDB Bzimport 2025-08-07 16:01:33 UTC 
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Comment 4 Tom Sweeney 2025-09-22 18:05:52 UTC 
As noted in this issue in Go and its follow on links: https://github.com/golang/go/issues/74831

This appears to be addressed in Go v1.23.12, v1.24.7, and v1.25.0 and higher.
Comment 7 errata-xmlrpc 2025-11-03 01:37:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:19397 https://access.redhat.com/errata/RHSA-2025:19397
Comment 8 errata-xmlrpc 2025-11-04 19:45:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:19731 https://access.redhat.com/errata/RHSA-2025:19731
Comment 9 errata-xmlrpc 2025-11-11 13:48:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:20909 https://access.redhat.com/errata/RHSA-2025:20909
Comment 10 errata-xmlrpc 2025-11-11 19:09:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:20983 https://access.redhat.com/errata/RHSA-2025:20983
Comment 11 errata-xmlrpc 2025-11-13 15:13:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:21336 https://access.redhat.com/errata/RHSA-2025:21336
Comment 12 errata-xmlrpc 2025-11-13 15:16:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:21337 https://access.redhat.com/errata/RHSA-2025:21337
Comment 13 errata-xmlrpc 2025-11-13 18:49:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:21383 https://access.redhat.com/errata/RHSA-2025:21383
Comment 14 errata-xmlrpc 2025-11-13 18:52:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Via RHSA-2025:21385 https://access.redhat.com/errata/RHSA-2025:21385
Comment 15 errata-xmlrpc 2025-11-13 18:53:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:21382 https://access.redhat.com/errata/RHSA-2025:21382
Comment 16 errata-xmlrpc 2025-11-13 18:53:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:21384 https://access.redhat.com/errata/RHSA-2025:21384
Comment 17 errata-xmlrpc 2025-11-25 02:09:10 UTC 
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2025:21148 https://access.redhat.com/errata/RHSA-2025:21148
Note You need to log in before you can comment on or make changes to this bug.