Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t46HM-00GPGo-OL for pgsql-bugs@arkaria.postgresql.org; Thu, 24 Oct 2024 22:26:05 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1t46HJ-008i4v-QM for pgsql-bugs@arkaria.postgresql.org; Thu, 24 Oct 2024 22:26:02 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t46HI-008i4j-GC for pgsql-bugs@lists.postgresql.org; Thu, 24 Oct 2024 22:26:01 +0000 Received: from fhigh-a2-smtp.messagingengine.com ([103.168.172.153]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t46HF-002nz2-Di for pgsql-bugs@lists.postgresql.org; Thu, 24 Oct 2024 22:26:00 +0000 Received: from phl-compute-03.internal (phl-compute-03.phl.internal [10.202.2.43]) by mailfhigh.phl.internal (Postfix) with ESMTP id 992671140188; Thu, 24 Oct 2024 18:25:55 -0400 (EDT) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-03.internal (MEProxy); Thu, 24 Oct 2024 18:25:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paquier.xyz; h= cc:cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1729808755; x=1729895155; bh=J59Dx9v5vJ FPqRPs0D6VPPKMqg4FUb17HsolP1wBPy0=; b=H6K6Rj/+glyblA2Dv3VQn9ftCK OiBhmZLHf7HGz2pfFCkf52cE3nMXNH5+jcHEtzmmmczN1KLMj5JzI6MMgf9b/SpY /k7/0hp1FQMuXV/0rRnU1soSsJXy/rFYFg8funtrK4tzZ3oEf2aN5QPfKG+01zFh wYsKkf4HEWFRlCMqHrG00Jc76T6UwZ+quEMLz6ris9+x/Q81qXAU4mvZ5N9Ghr4i jswYG6/9WlL7f/X65j6VU0UeAkJiyR5G+P/vpQNJvgHkVDYVdN/8ZU4eJ1+6R0W2 TzGQxt+Azty2eJX7ssADlaZnIiaLchFJeUNuXqVchRZl4LPMbypKBP9DRtHw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; t=1729808755; x=1729895155; bh=J59Dx9v5vJFPqRPs0D6VPPKMqg4F Ub17HsolP1wBPy0=; b=JUkjDjsFQRoImiiwre3LyZ18jIZ3chYzA6M5ZBvxQSNW JB1WjMgJmSARcMyuXilR8Jicq0pHdTyzZhNnBgoB14i64PCXeZf7hZT3UJuVtk0g 6wJOm+LSV9KAypSLgUSw0GU4xyxvoUuxi50maDa47iXDu9CAgs2EOsciY/Y1DGUf wW1mYCdJbi3IudQKNwk9c6COiD/yC/wIg8tIFSOqHkhoiMbrrvrFj774MWx2PSqt FYE/Np+ktzR4Oge1nm3BeREBtC5Taz1AneZ6kQvPR2WTjXNz6zWCZzFjHR7/WhmC PRB6K5oRvdb5rSRSveUB+FZO7QkrlagJ93vAYbLmRg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeftddrvdejuddgtdelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggvpdfu rfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnh htshculddquddttddmnegfrhhlucfvnfffucdljedtmdenucfjughrpeffhffvvefukfhf gggtuggjsehgtderredttdejnecuhfhrohhmpefoihgthhgrvghlucfrrghquhhivghruc eomhhitghhrggvlhesphgrqhhuihgvrhdrgiihiieqnecuggftrfgrthhtvghrnhepveet jefgjeevgedukeehieeuieeuieevueeiudegheevuefggfduueelgeelieetnecuvehluh hsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepmhhitghhrggvlhes phgrqhhuihgvrhdrgiihiidpnhgspghrtghpthhtohepfedpmhhouggvpehsmhhtphhouh htpdhrtghpthhtohepphdrnhgvkhhrrghsohhvsehfohgsohhsqdhnthdrrhhupdhrtghp thhtohepsghruhgtvgesmhhomhhjihgrnhdruhhspdhrtghpthhtohepphhgshhqlhdqsg hughhssehlihhsthhsrdhpohhsthhgrhgvshhqlhdrohhrgh X-ME-Proxy: Feedback-ID: i0fe9450f:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 24 Oct 2024 18:25:53 -0400 (EDT) Date: Fri, 25 Oct 2024 07:25:26 +0900 From: Michael Paquier To: =?utf-8?B?0J/QsNCy0LXQuyDQndC10LrRgNCw0YHQvtCy?= Cc: Bruce Momjian , pgsql-bugs@lists.postgresql.org Subject: Re: BUG #18614: [ECPG] out of bound in DecodeDateTime Message-ID: References: <18614-6bbe00117352309e@postgresql.org> <1964872402.1671046.1729760950957.JavaMail.zimbra@fobos-nt.ru> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="jXNTkcEaMJwbnaj8" Content-Disposition: inline In-Reply-To: <1964872402.1671046.1729760950957.JavaMail.zimbra@fobos-nt.ru> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --jXNTkcEaMJwbnaj8 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Oct 24, 2024 at 12:09:10PM +0300, =D0=9F=D0=B0=D0=B2=D0=B5=D0=BB = =D0=9D=D0=B5=D0=BA=D1=80=D0=B0=D1=81=D0=BE=D0=B2 wrote: > I would like to clarify two points: >=20 > 1. Are there any known examples of large open-source projects that > actively use the ecpg? Yes, some large organizations use it. > 2. Do you think it would be appropriate to assign a CVE for this bug? Nope, this issue does not qualify as worth a CVE when it comes to PostgreSQL. -- Michael --jXNTkcEaMJwbnaj8 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmcayVYACgkQnvQgOdby QH27Ug/7BhxLccS/DAPe+m48m9dcEg9VmFNBbptxLsEfTCOTMgjs8leQiZKZ+zps rT/nreaXQ1jmkT/xmnXWPFxr5ZAzAKVFK0vPUs55Yv7P22kyD8zPHtAFMrP2Z45k E96xCCeBg2AKpSaUyaOVewuz90ef5PtgAhR1TCAbvGCIeUsP3MJMFhhq44ShY8rZ dS99CLfwNCq8+MiW+JHp7QVMHPf03+5cODvEFiQM9bE1lB1xOqRae7pjABni7qos uCtlb6tsjUG3bedUeysSkTncUOWuFmgsEasAvvJ4lqUz5+IAY49mkXo0tfBksGfZ ZT6pfhCHBcOYBiIy24+7xizsX3Z7VNwr4cJp2jYkzUNtBzrEKlA6AgM1whSZwf8V mQ32azs3bNEwkvxaGCqB5GWxcz/uajEyYNi1RTev/48eh/0lC5L8Y2nLP+h4uWbe /XLvcbfJMqpgrTqgAiNxv5gLCwMA9/EW+Jk03Xuo2Pa00eccApbfU64tFiP3ZAgN 5IbcLSIsA+31AQJsE/TOFzWcBim0UmXMkCfRv45zUQdi26xUEMaTs53oMjT1PWzW baWLG5K5Lk8w87Cc0i0CEkcOZUTdWuYSIQgZbwEomQc40qlMHinJ+IToPfm4C6GT lfqvoSid1+zGnFOQg8ZfviIHbSb35ZKtua2+6plm0RK+9KizsuA= =SQqd -----END PGP SIGNATURE----- --jXNTkcEaMJwbnaj8--