pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #18193: CVE-2019-9193
4+ messages / 4 participants
[nested] [flat]
* BUG #18193: CVE-2019-9193
@ 2023-11-13 06:30 PG Bug reporting form <noreply@postgresql.org>
2023-11-13 12:17 ` Re: BUG #18193: CVE-2019-9193 hubert depesz lubaczewski <depesz@depesz.com>
2023-11-13 15:20 ` Re: BUG #18193: CVE-2019-9193 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 2 replies; 4+ messages in thread
From: PG Bug reporting form @ 2023-11-13 06:30 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: sumanth.vankineni@gmail.com
The following bug has been logged on the website:
Bug reference: 18193
Logged by: Sumanth Vankineni
Email address: sumanth.vankineni@gmail.com
PostgreSQL version: 13.7
Operating system: Linux
Description:
Just wanted to give an update, I'm not sure if it's mentioned anywhere on
the website. The PostgreSQl version 13.7 is also vuln to the
CVE-2019-9193.
The CVE states only In PostgreSQL 9.3 through 11.2.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #18193: CVE-2019-9193
2023-11-13 06:30 BUG #18193: CVE-2019-9193 PG Bug reporting form <noreply@postgresql.org>
@ 2023-11-13 12:17 ` hubert depesz lubaczewski <depesz@depesz.com>
1 sibling, 0 replies; 4+ messages in thread
From: hubert depesz lubaczewski @ 2023-11-13 12:17 UTC (permalink / raw)
To: sumanth.vankineni@gmail.com; pgsql-bugs@lists.postgresql.org
On Mon, Nov 13, 2023 at 06:30:43AM +0000, PG Bug reporting form wrote:
> The following bug has been logged on the website:
>
> Bug reference: 18193
> Logged by: Sumanth Vankineni
> Email address: sumanth.vankineni@gmail.com
> PostgreSQL version: 13.7
> Operating system: Linux
> Description:
>
> Just wanted to give an update, I'm not sure if it's mentioned anywhere on
> the website. The PostgreSQl version 13.7 is also vuln to the
> CVE-2019-9193.
> The CVE states only In PostgreSQL 9.3 through 11.2.
You might want to read
https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/
depesz
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #18193: CVE-2019-9193
2023-11-13 06:30 BUG #18193: CVE-2019-9193 PG Bug reporting form <noreply@postgresql.org>
@ 2023-11-13 15:20 ` Tom Lane <tgl@sss.pgh.pa.us>
2023-11-13 15:30 ` Re: BUG #18193: CVE-2019-9193 David G. Johnston <david.g.johnston@gmail.com>
1 sibling, 1 reply; 4+ messages in thread
From: Tom Lane @ 2023-11-13 15:20 UTC (permalink / raw)
To: sumanth.vankineni@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> Just wanted to give an update, I'm not sure if it's mentioned anywhere on
> the website. The PostgreSQl version 13.7 is also vuln to the
> CVE-2019-9193.
> The CVE states only In PostgreSQL 9.3 through 11.2.
Please see
https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/
That CVE is erroneous in full, and so the fact that it also misstates
relevant versions is hardly surprising.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #18193: CVE-2019-9193
2023-11-13 06:30 BUG #18193: CVE-2019-9193 PG Bug reporting form <noreply@postgresql.org>
2023-11-13 15:20 ` Re: BUG #18193: CVE-2019-9193 Tom Lane <tgl@sss.pgh.pa.us>
@ 2023-11-13 15:30 ` David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 0 replies; 4+ messages in thread
From: David G. Johnston @ 2023-11-13 15:30 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: sumanth.vankineni@gmail.com <sumanth.vankineni@gmail.com>; pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
On Monday, November 13, 2023, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> PG Bug reporting form <noreply@postgresql.org> writes:
> > Just wanted to give an update, I'm not sure if it's mentioned anywhere on
> > the website. The PostgreSQl version 13.7 is also vuln to the
> > CVE-2019-9193.
> > The CVE states only In PostgreSQL 9.3 through 11.2.
>
> Please see
>
> https://www.postgresql.org/about/news/cve-2019-9193-not-
> a-security-vulnerability-1935/
>
> That CVE is erroneous in full, and so the fact that it also misstates
> relevant versions is hardly surprising.
>
>
It’s hardly surprising because a CVE from 2019 (they make this fairly
simple, the year is in the assigned number) would not be expected to list
version 13 as that was not released at the time. Assuming 11.2 was indeed
the most recent version released at the time the CVE was issued then indeed
neither v12 nor v13 were relevant as v11 was only about 6 months old.
David J.
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2023-11-13 15:30 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-11-13 06:30 BUG #18193: CVE-2019-9193 PG Bug reporting form <noreply@postgresql.org>
2023-11-13 12:17 ` hubert depesz lubaczewski <depesz@depesz.com>
2023-11-13 15:20 ` Tom Lane <tgl@sss.pgh.pa.us>
2023-11-13 15:30 ` David G. Johnston <david.g.johnston@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox