VBR v12 with PostgreSQL -- security patching

[Frosty]

We have a newish Windows Server 2025 deploy of VBR v12 running latest patch and using PostgreSQL as the database.
CrowdStrike (antivirus/antimalware/etc) reports some vulnerabilities in the version of PostgreSQL and wants it updated.
Ideally I would wait for a "next VBR patch" and then hopefully it would update PostgreSQL for me.
I suppose I could try applying PostgreSQL patches myself, but I really would prefer to keep everything lined up version-wise.
Anyone else in the same boat? Recommended courses of action? How do y'all handle the competing priorities/risks?

[karsten123]

you have to update postgresql by yourself

[Gostev]

Installable software for Microsoft Windows is self-managed so you have to patch everything yourself.

Our software appliance is fully managed so it's "set and forget" for you in terms of on-going patching and hardening, we take care of all of this for you.

[somoa]

My plan is to follow this but so far have not tried it.

https://gist.github.com/truemogician/61 ... 3b9da1ff1a

Combine it with stopping and config backup of Veeam as shown here
https://www.veeam.com/kb4386

I have only updated within major version so far.

If major update goes badly, Plan is to recover Veeam config onto a new postgre instance.

[Mildur]

Hi somoa,

Let us know how it goes.

Deploying a new PostgreSQL instance should also work fine. Just keep in mind that if you’re using the same machine where the previous instance is installed, the port number for the new instance will not be the default 5432 — it will most likely be 5433.

You can verify the port in either of the following files (on Windows):

• C:\Program Files\PostgreSQL\<pg version>\installation_summary.log
• C:\Program Files\PostgreSQL\<pg version>\data\postgresql.conf

PostgreSQL on Linux machines have a similar configuration file in:

• /etc/postgresql/<pg version>/main

Best regards,
Fabian