From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: "Vibhu Chauhan (iDEAS-ER&D)" <vibhu.chauhan@wipro.com>,
        "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: OpenSSL v1.1.1n in postgres
In-reply-to: <3CF81050-F834-4000-99C0-8BC2E805CFAB@yesql.se>
References: 
 <TYZPR03MB61083FA623BE6FF1580A1B11F01B9@TYZPR03MB6108.apcprd03.prod.outlook.com>
 <3CF81050-F834-4000-99C0-8BC2E805CFAB@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Sat, 26 Mar 2022 21:32:19 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <146122.1648327136.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Sat, 26 Mar 2022 16:38:56 -0400
Message-ID: <146123.1648327136@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/146123.1648327136%40sss.pgh.pa.us>
Precedence: bulk

Daniel Gustafsson <daniel@yesql.se> writes:
>> On 26 Mar 2022, at 18:32, Vibhu Chauhan (iDEAS-ER&D) <vibhu.chauhan@wip=
ro.com> wrote:
>> In one security scan we found that OpenSSL v1.1.1k is vulnerable which =
is sub-component of postgres 13.3.  From below link we came to know that a=
ffected OpenSSL version 1.1.1k is fixed in 1.1.1n version. We wanted to kn=
ow which postgres version having this fix version of OpenSSL? And is there=
 any steps to mitigate the risk of version 1.1.1k?

> PostgreSQL doesn't come statically linked to any OpenSSL version, you ne=
ed to
> ask your system administrators and/or PostgreSQL service provider about =
this.

The question is possibly about the EDB Windows installer, but
it would still be better directed to EDB's support people.

			regards, tom lane