pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed

CVE-2024-28849
3+ messages / 3 participants
[nested] [flat]

* CVE-2024-28849
@ 2024-04-18 15:27  Mathews, Rob <rpmathe@sandia.gov>
  0 siblings, 1 reply; 3+ messages in thread

From: Mathews, Rob @ 2024-04-18 15:27 UTC (permalink / raw)
  To: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>

All,

   CVE-2024-28849 was found in Version 15.6 and 16.2 this week. Please refer to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28849 for issues and corrections.
The Binaries .zip files were the files scanned and found with the vulnerability. There are no known workarounds for this vulnerability.

Thank You,

Robert

Robert P. Mathews
rpmathe@sandia.gov<mailto:rpmathe@sandia.gov>

^ permalink  raw  reply  [nested|flat] 3+ messages in thread

* Re: CVE-2024-28849
@ 2024-04-18 17:25  Jonathan S. Katz <jkatz@postgresql.org>
  parent: Mathews, Rob <rpmathe@sandia.gov>
  0 siblings, 1 reply; 3+ messages in thread

From: Jonathan S. Katz @ 2024-04-18 17:25 UTC (permalink / raw)
  To: Mathews, Rob <rpmathe@sandia.gov>; pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>

On 4/18/24 11:27 AM, Mathews, Rob wrote:
> All,
> 
>     CVE-2024-28849 was found in Version 15.6 and 16.2 this week. Please 
> refer to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28849 
> <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28849; for 
> issues and corrections.
> 
> The Binaries .zip files were the files scanned and found with the 
> vulnerability. There are no known workarounds for this vulnerability.

PostgreSQL doesn't have any dependencies on node.js, let alone 
JavaScript. This CVE doesn't apply to PostgreSQL.

If you are using a package to install PostgreSQL (as it sounds like you 
are), you'll need to reach out to the package maintainers.

Jonathan



Attachments:

  OpenPGP_signature.asc (application/pgp-signature, 839B) download

^ permalink  raw  reply  [nested|flat] 3+ messages in thread

* Re: CVE-2024-28849
@ 2024-04-18 17:37  Jerry Sievert <jerry@legitimatesounding.com>
  parent: Jonathan S. Katz <jkatz@postgresql.org>
  0 siblings, 0 replies; 3+ messages in thread

From: Jerry Sievert @ 2024-04-18 17:37 UTC (permalink / raw)
  To: Jonathan S. Katz <jkatz@postgresql.org>; +Cc: Mathews, Rob <rpmathe@sandia.gov>; PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>

RE: Postgres and Javascript

> On Apr 18, 2024, at 10:25 AM, Jonathan S. Katz <jkatz@postgresql.org> wrote:
> 
> On 4/18/24 11:27 AM, Mathews, Rob wrote:
>> All,
>>    CVE-2024-28849 was found in Version 15.6 and 16.2 this week. Please refer to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28849 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28849; for issues and corrections.
>> The Binaries .zip files were the files scanned and found with the vulnerability. There are no known workarounds for this vulnerability.
> 
> PostgreSQL doesn't have any dependencies on node.js, let alone JavaScript. This CVE doesn't apply to PostgreSQL.

PLV8 and PLJS also have no dependencies from node.js, and do not have this dependency specifically, so are also not affected, even though they implement a Javascript runtime.






^ permalink  raw  reply  [nested|flat] 3+ messages in thread

end of thread, other threads:[~2024-04-18 17:37 UTC | newest]

Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2024-04-18 15:27 CVE-2024-28849 Mathews, Rob <rpmathe@sandia.gov>
2024-04-18 17:25 ` Jonathan S. Katz <jkatz@postgresql.org>
2024-04-18 17:37   ` Jerry Sievert <jerry@legitimatesounding.com>

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox