Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1r2Yjy-00HPdv-Bi
	for pgsql-bugs@arkaria.postgresql.org; Mon, 13 Nov 2023 15:20:42 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.94.2)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1r2Yjw-00G8FY-Qk
	for pgsql-bugs@arkaria.postgresql.org; Mon, 13 Nov 2023 15:20:40 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1r2Yjw-00G8Ec-I6
	for pgsql-bugs@lists.postgresql.org; Mon, 13 Nov 2023 15:20:40 +0000
Received: from sss.pgh.pa.us ([68.162.161.243])
	by magus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1r2Yjp-006ESp-CQ
	for pgsql-bugs@lists.postgresql.org; Mon, 13 Nov 2023 15:20:39 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 3ADFKU9P1985243;
	Mon, 13 Nov 2023 10:20:31 -0500
From: Tom Lane <tgl@sss.pgh.pa.us>
To: sumanth.vankineni@gmail.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18193: CVE-2019-9193
In-reply-to: <18193-9d57393593895996@postgresql.org>
References: <18193-9d57393593895996@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Mon, 13 Nov 2023 06:30:43 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1985241.1699888830.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 13 Nov 2023 10:20:30 -0500
Message-ID: <1985242.1699888830@sss.pgh.pa.us>
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Archived-At: 
 <https://www.postgresql.org/message-id/1985242.1699888830%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> Just wanted to give an update, I'm not sure if it's mentioned anywhere o=
n
> the website. The PostgreSQl version 13.7 is also vuln to the
> CVE-2019-9193.
> The CVE states only In PostgreSQL 9.3 through 11.2.

Please see

https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnera=
bility-1935/

That CVE is erroneous in full, and so the fact that it also misstates
relevant versions is hardly surprising.

			regards, tom lane