"This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update immediately."
[deleted]
PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
21–30 of 105 posts
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#22I'm a little confused about their release strategy. Perhaps someone can explain it to me.
They took their repositories private to secretly develop the bug fix. Then they released the fixed versions along with what seem to be enough details to trigger the bug for anyone who hasn't patched.
Sure the patch contains the same information in source form, but if they'd gone light on details while saying "seriously, go get this", there'd probably be fewer curious vandals trying to delete your database while you're reading HN.
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#23"This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update immediately."
[deleted]
Debian has it. I assume Ubuntu does as well... at least for the 8.4 version.
---
PostgreSQL 8.4.17 on x86_64-pc-linux-gnu, compiled by GCC gcc-4.4.real (Debian 4.4.5-8) 4.4.5, 64-bit
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#24Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#25This is the main vulnerability I presume > A connection request containing a database name that begins with "-" may be crafted to damage or destroy files within a server's data directory I just. No words.
defense in depth though, users shouldn't be able to craft connection requests to begin with
[deleted]
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#26"This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update immediately."
[deleted]
Ubuntu 12.04 already has the new package version of 9.1. Your mirror may be outdated (we use the Portuguese default).
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#27This is the main vulnerability I presume > A connection request containing a database name that begins with "-" may be crafted to damage or destroy files within a server's data directory I just. No words.
Getting this stuff right is hard. Don't be a hater. Just because the attack vector looks simple doesn't mean the bug was obvious.
Absolutely. Remember the MySQL authentication bypass vulnerability¹, where a blank password would succeed to authenticate 1/255th of the time? This reminds me of that.
1: http://thehackernews.com/2012/06/cve-2012-2122-serious-mysql...
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#28This is the main vulnerability I presume > A connection request containing a database name that begins with "-" may be crafted to damage or destroy files within a server's data directory I just. No words.
defense in depth though, users shouldn't be able to craft connection requests to begin with
Then how would a user use the db? Not every use of a database is behind a web application.
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#29Earlier quoted context omitted.
[deleted]
It worked for me on Ubunutu - maybe it takes a bit of time to get around to all of the mirrors.
You are correct, and now I have egg on my face: http://www.ubuntu.com/usn/usn-1789-1/
I was going purely by the changelog in: http://packages.ubuntu.com/precise/database/postgresql-9.1 http://packages.ubuntu.com/precise-updates/postgresql-9.1
Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
#30"This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update immediately."
[deleted]
This is terrible advice. Installing another postgres binary from a different source is likely going to cause you headaches.
And it's not necessary - vendors such as Red Hat and Debian are fast with security updates. Given that Red Hat helped them apply for the CVE the non-version-9 fixes should be out PDQ. You can keep an eye on it here: https://access.redhat.com/security/cve/