From: Tom Lane <tgl@sss.pgh.pa.us>
To: David G. Johnston <david.g.johnston@gmail.com>
Cc: Daniel Gustafsson <daniel@yesql.se>
Cc: Vibhu Chauhan (iDEAS-ER&D) <vibhu.chauhan@wipro.com>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: OpenSSL v1.1.1n in postgres
Date: Sat, 26 Mar 2022 17:17:20 -0400
Message-ID: <167221.1648329440@sss.pgh.pa.us> (raw)
In-Reply-To: <CAKFQuwY-KYfG7bWSq1P2rD7yPQ1+uLQdRfdb+QEW8L4XgCCW9Q@mail.gmail.com>
References: <TYZPR03MB61083FA623BE6FF1580A1B11F01B9@TYZPR03MB6108.apcprd03.prod.outlook.com>
<3CF81050-F834-4000-99C0-8BC2E805CFAB@yesql.se>
<146123.1648327136@sss.pgh.pa.us>
<CAKFQuwY-KYfG7bWSq1P2rD7yPQ1+uLQdRfdb+QEW8L4XgCCW9Q@mail.gmail.com>
"David G. Johnston" <david.g.johnston@gmail.com> writes:
> I do find it sad that this question about when a CVE has been patched is
> being asked where the active version is 10 months old and missing 3
> PostgreSQL CVE fixes, including an SSL related one in 13.5
In the OP's defense, this OpenSSL CVE does look a lot scarier than
any of ours ... if I'm reading it right, anyone who can reach your
postmaster port can arrange to chew 100% CPU on your server.
OTOH, they can't do anything more than that, and you probably
shouldn't have your DB server accessible from the open internet
anyway.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, david.g.johnston@gmail.com, daniel@yesql.se, vibhu.chauhan@wipro.com, pgsql-bugs@lists.postgresql.org
Subject: Re: OpenSSL v1.1.1n in postgres
In-Reply-To: <167221.1648329440@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox