From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Vibhu Chauhan (iDEAS-ER&D) <vibhu.chauhan@wipro.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: OpenSSL v1.1.1n in postgres
Date: Sat, 26 Mar 2022 16:38:56 -0400
Message-ID: <146123.1648327136@sss.pgh.pa.us> (raw)
In-Reply-To: <3CF81050-F834-4000-99C0-8BC2E805CFAB@yesql.se>
References: <TYZPR03MB61083FA623BE6FF1580A1B11F01B9@TYZPR03MB6108.apcprd03.prod.outlook.com>
<3CF81050-F834-4000-99C0-8BC2E805CFAB@yesql.se>
Daniel Gustafsson <daniel@yesql.se> writes:
>> On 26 Mar 2022, at 18:32, Vibhu Chauhan (iDEAS-ER&D) <vibhu.chauhan@wipro.com> wrote:
>> In one security scan we found that OpenSSL v1.1.1k is vulnerable which is sub-component of postgres 13.3. From below link we came to know that affected OpenSSL version 1.1.1k is fixed in 1.1.1n version. We wanted to know which postgres version having this fix version of OpenSSL? And is there any steps to mitigate the risk of version 1.1.1k?
> PostgreSQL doesn't come statically linked to any OpenSSL version, you need to
> ask your system administrators and/or PostgreSQL service provider about this.
The question is possibly about the EDB Windows installer, but
it would still be better directed to EDB's support people.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, vibhu.chauhan@wipro.com, pgsql-bugs@lists.postgresql.org
Subject: Re: OpenSSL v1.1.1n in postgres
In-Reply-To: <146123.1648327136@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox