CVE-2025-0218

What it actually does

Insufficiently seeded RNG used to generate temporary directory names for batch job scripts executed by pgAgent allows local attackers to pre-create the expected directory and block job execution.

Why it matters to the business

Scheduled database maintenance and automation tasks fail to run, causing operational disruptions and potential data processing delays across affected systems.

How an attack unfolds

A local attacker monitors pgAgent activity, predicts the weakly generated temporary directory name, pre-creates the directory ahead of job execution, and thereby prevents the script from running as scheduled.

How to fix it

Upgrade pgAgent to version 4.2.3 or later; verify all instances use the patched release that employs a secure directory naming mechanism.

How to confirm the fix worked

Confirm pgAgent version is 4.2.3 or higher; test scheduled jobs to ensure temporary directories are uniquely generated and inaccessible to unprivileged local users.

Typical attack path

1. Identify systems running vulnerable pgAgent versions
2. Observe timing and patterns of scheduled batch jobs
3. Predict or brute-force the temporary directory name via weak RNG
4. Pre-create the directory with appropriate permissions
5. Allow pgAgent to attempt execution and observe job failure

How to detect it

Search job execution logs for repeated failures involving temporary directory creation or permission errors; monitor for unexpected directory pre-creation activity by non-pgAgent processes.

What your security team should do

• Immediately inventory all pgAgent deployments and prioritize upgrade to 4.2.3+
• Review scheduled job logs for repeated directory-related failures
• Restrict local user access on systems hosting pgAgent until patched