Re[2]: CVE-2022-2625

Поиск
Список
Период
Сортировка
От misha1966 misha1966
Тема Re[2]: CVE-2022-2625
Дата
Msg-id 1663215861.183275184@f728.i.mail.ru
обсуждение исходный текст
Ответ на CVE-2022-2625  (misha1966 misha1966 <mmisha1966@bk.ru>)
Ответы Re: Re[2]: CVE-2022-2625  (Laurenz Albe <laurenz.albe@cybertec.at>)
Re: CVE-2022-2625  (Ron <ronljohnsonjr@gmail.com>)
Список pgsql-general
All business processes are hooked on postgresql 9.5. There is no way to update.
Unfortunately, I don't have the proper qualifications to change it.
 
Четверг, 15 сентября 2022, 1:58 +09:00 от Laurenz Albe <laurenz.albe@cybertec.at>:
 
On Wed, 2022-09-14 at 17:02 +0300, misha1966 misha1966 wrote:
> Tell me, is there a CVE-2022-2625 vulnerability in posgresql 9.5?
> If so, who knows how to patch it? Patches from version 10 are not suitable at all...

Yes, that vulnerability exists in 9.5.

To patch that, you'd have to try and backpatch the commit to 9.5 yourself:
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=b9b21acc766db54d8c337d508d0fe2f5bf2daab0

Since 9.5 is out of support, there are no more bugfixes for it provided
by the community. If security were a real concern for you, you would
certainly not be running a PostgreSQL version that is out of support.

Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
 
 

В списке pgsql-general по дате отправления:

Предыдущее
От: Bryn Llewellyn
Дата:
Сообщение: Re: Is it possible to stop sessions killing eachother when they all authorize as the same role?
Следующее
От: Tom Lane
Дата:
Сообщение: Re: Is it possible to stop sessions killing eachother when they all authorize as the same role?