pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #17907: PostgresSQL 15.x contains OpenSSL DLLs (vulnerable to CVE-2023-0464, CVE-2023-0465 & CVE-2023-0466)
2+ messages / 2 participants
[nested] [flat]
* BUG #17907: PostgresSQL 15.x contains OpenSSL DLLs (vulnerable to CVE-2023-0464, CVE-2023-0465 & CVE-2023-0466)
@ 2023-04-24 14:34 PG Bug reporting form <noreply@postgresql.org>
0 siblings, 1 reply; 2+ messages in thread
From: PG Bug reporting form @ 2023-04-24 14:34 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: ascott@wwf.org.uk
The following bug has been logged on the website:
Bug reference: 17907
Logged by: Adrian Scott
Email address: ascott@wwf.org.uk
PostgreSQL version: 15.2
Operating system: Windows 10 Enterprise 64 bit
Description:
We have been alerted to the existence of 3 OpenSSL vulnerabilities that are
exposed within the OpenSSL v3.0.8 DLLs installed as part of the PostgresSQL
15.x install.
In the default install paths the 2 files are found here:
c:\program files\postgresql\15\bin\libcrypto-3-x64.dll
c:\program files\postgresql\15\bin\libssl-3-x64.dll
These are affected by vulnerabilities CVE-2023-0464, CVE-2023-0465 &
CVE-2023-0466
Please can you update the PostgresSQL distributions to include the latest
OpenSSL dlls with your next bugfixed release (either using OpenSSL 3.1.1 or
3.0.9), to remove these vulnerabilities?
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #17907: PostgresSQL 15.x contains OpenSSL DLLs (vulnerable to CVE-2023-0464, CVE-2023-0465 & CVE-2023-0466)
@ 2023-04-27 07:43 Sandeep Thakkar <sandeep.thakkar@enterprisedb.com>
parent: PG Bug reporting form <noreply@postgresql.org>
0 siblings, 0 replies; 2+ messages in thread
From: Sandeep Thakkar @ 2023-04-27 07:43 UTC (permalink / raw)
To: ascott@wwf.org.uk; pgsql-bugs@lists.postgresql.org
Hi,
In the security advisory, the OpenSSL community had mentioned
"Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when
they become available."
So once the version 3.0.9 (and 1.1.1 update) we will rewrap the PostgreSQL
installers
On Thu, Apr 27, 2023 at 12:21 PM PG Bug reporting form <
noreply@postgresql.org> wrote:
> The following bug has been logged on the website:
>
> Bug reference: 17907
> Logged by: Adrian Scott
> Email address: ascott@wwf.org.uk
> PostgreSQL version: 15.2
> Operating system: Windows 10 Enterprise 64 bit
> Description:
>
> We have been alerted to the existence of 3 OpenSSL vulnerabilities that are
> exposed within the OpenSSL v3.0.8 DLLs installed as part of the PostgresSQL
> 15.x install.
> In the default install paths the 2 files are found here:
> c:\program files\postgresql\15\bin\libcrypto-3-x64.dll
> c:\program files\postgresql\15\bin\libssl-3-x64.dll
>
> These are affected by vulnerabilities CVE-2023-0464, CVE-2023-0465 &
> CVE-2023-0466
>
> Please can you update the PostgresSQL distributions to include the latest
> OpenSSL dlls with your next bugfixed release (either using OpenSSL 3.1.1 or
> 3.0.9), to remove these vulnerabilities?
>
>
--
Sandeep Thakkar
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2023-04-27 07:43 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-04-24 14:34 BUG #17907: PostgresSQL 15.x contains OpenSSL DLLs (vulnerable to CVE-2023-0464, CVE-2023-0465 & CVE-2023-0466) PG Bug reporting form <noreply@postgresql.org>
2023-04-27 07:43 ` Sandeep Thakkar <sandeep.thakkar@enterprisedb.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox