17

Security Information The PostgreSQL Global Development Group (PGDG) takes security seriously. This allows our users to place their trust in PostgreSQL for protecting their mission-critical data. The PostgreSQL Global Development Group follows a model that shares responsibility between PostgreSQL itself and its deployment environment, including hardware, operating system, and the application layer (programming language, frameworks and client libraries). The PostgreSQL documentation provides info on the inherent security features of PostgreSQL and how to securely configure and run PostgreSQL. Security vulnerabilities can exist both in PostgreSQL and software within the PostgreSQL ecosystem, including client libraries, extensions, installers, and other utilities. This page walks through what is considered a security vulnerability in PostgreSQL, how to report PostgreSQL security vulnerabilities, and how fixes for security vulnerabilities are released. Please note that the PostgreSQL Project does not offer bug bounties. CVE Numbering Authority The PostgreSQL Project is a CVE Numbering Authority (CNA), working with Red Hat as our CNA Root. This allows us to assign our own CVE numbers and publish CVE records for PostgreSQL and closely related projects. We will currently assign CVE numbers for the following projects upon request to [email protected]: PostgreSQL PostgreSQL RPM packaging PostgreSQL DEB packaging PostgreSQL Windows/macOS installers (EDB) pgJDBC psqlODBC pgAdmin PgBouncer PostgreSQL Anonymizer pgvector Additional projects may request inclusion on the list above by emailing [email protected]. NOTE: The security team will only assign CVEs to projects when requested by members of the project. If you think you've found a security issue in a project other than Postgre