From: Jonathan S. Katz <jkatz@postgresql.org>
To: Mathews, Rob <rpmathe@sandia.gov>
To: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: CVE-2024-28849
Date: Thu, 18 Apr 2024 13:25:38 -0400
Message-ID: <b58f9bae-80d4-442c-a4ca-557733ba47c7@postgresql.org> (raw)
In-Reply-To: <PH0PR09MB78988C26C34EAE818A1D3107CD0E2@PH0PR09MB7898.namprd09.prod.outlook.com>
References: <PH0PR09MB78988C26C34EAE818A1D3107CD0E2@PH0PR09MB7898.namprd09.prod.outlook.com>
On 4/18/24 11:27 AM, Mathews, Rob wrote:
> All,
>
> CVE-2024-28849 was found in Version 15.6 and 16.2 this week. Please
> refer to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28849
> <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28849; for
> issues and corrections.
>
> The Binaries .zip files were the files scanned and found with the
> vulnerability. There are no known workarounds for this vulnerability.
PostgreSQL doesn't have any dependencies on node.js, let alone
JavaScript. This CVE doesn't apply to PostgreSQL.
If you are using a package to install PostgreSQL (as it sounds like you
are), you'll need to reach out to the package maintainers.
Jonathan
Attachments:
OpenPGP_signature.asc (application/pgp-signature, 839B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: jkatz@postgresql.org, rpmathe@sandia.gov, pgsql-bugs@lists.postgresql.org
Subject: Re: CVE-2024-28849
In-Reply-To: <b58f9bae-80d4-442c-a4ca-557733ba47c7@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox