From: Tom Lane <tgl@sss.pgh.pa.us>
To: "David G. Johnston" <david.g.johnston@gmail.com>
cc: Daniel Gustafsson <daniel@yesql.se>,
        "Vibhu Chauhan (iDEAS-ER&D)" <vibhu.chauhan@wipro.com>,
        "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: OpenSSL v1.1.1n in postgres
In-reply-to: 
 <CAKFQuwY-KYfG7bWSq1P2rD7yPQ1+uLQdRfdb+QEW8L4XgCCW9Q@mail.gmail.com>
References: 
 <TYZPR03MB61083FA623BE6FF1580A1B11F01B9@TYZPR03MB6108.apcprd03.prod.outlook.com>
 <3CF81050-F834-4000-99C0-8BC2E805CFAB@yesql.se>
 <146123.1648327136@sss.pgh.pa.us>
 <CAKFQuwY-KYfG7bWSq1P2rD7yPQ1+uLQdRfdb+QEW8L4XgCCW9Q@mail.gmail.com>
Comments: In-reply-to "David G. Johnston" <david.g.johnston@gmail.com>
	message dated "Sat, 26 Mar 2022 13:45:45 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <167220.1648329440.1@sss.pgh.pa.us>
Date: Sat, 26 Mar 2022 17:17:20 -0400
Message-ID: <167221.1648329440@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/167221.1648329440%40sss.pgh.pa.us>
Precedence: bulk

"David G. Johnston" <david.g.johnston@gmail.com> writes:
> I do find it sad that this question about when a CVE has been patched is
> being asked where the active version is 10 months old and missing 3
> PostgreSQL CVE fixes, including an SSL related one in 13.5

In the OP's defense, this OpenSSL CVE does look a lot scarier than
any of ours ... if I'm reading it right, anyone who can reach your
postmaster port can arrange to chew 100% CPU on your server.
OTOH, they can't do anything more than that, and you probably
shouldn't have your DB server accessible from the open internet
anyway.

			regards, tom lane