From: "Abraham, Danny" <danny_abraham@bmc.com>
To: Laurenz Albe <laurenz.albe@cybertec.at>,
        "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Subject: Re: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG
 CVE-2025-1094 i
Thread-Topic: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG
 CVE-2025-1094 i
Thread-Index: AduOaq+oBG+0sgRgSkednXepiY1Y/AABLR6AAALc7z4=
Date: Thu, 6 Mar 2025 09:33:39 +0000
Message-ID: <14fc085b-1d48-4bc0-9d44-1d11507c0ded@bmc.com>
References:
 <SA1PR02MB969837F0BEDE8CD64AE703958ECA2@SA1PR02MB9698.namprd02.prod.outlook.com>
 <b76f0f54cbf8bd4ebe84eecea44168f23fcc2074.camel@cybertec.at>
In-Reply-To: <b76f0f54cbf8bd4ebe84eecea44168f23fcc2074.camel@cybertec.at>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?iso-8859-1?Q?kiZC+Ferilk+XvD9G2Z3sb0hRiy++JZjAGfBkMpkK+FF3Hl0zwW5CG73Yi?=
 =?iso-8859-1?Q?wcyLEOo0T6VtDk6x9fjs4c0mxtxnAJ8xRnFT0qcCyc1hZBC2sBMdg3f9+T?=
 =?iso-8859-1?Q?JW/HK969W54tFWmOjcrK9/ebNMslDAiKBSDhwObfJCFKOb1oNtcl39H985?=
 =?iso-8859-1?Q?S+LdYEgBrYCSUOIVnDDLVDARxN9ZLIZFFZ8HR5TGNswhpc0H9tUPJW/pcN?=
 =?iso-8859-1?Q?BJXc9SsQrryjKsdWHEXHYJpyOl6wrwD+QXNHRnkCIQV0zIUJL0evZ4sO2g?=
 =?iso-8859-1?Q?AoTztP2W65G5LPQwhPe/elVH3K/lXU1rMMr/cPhm/D9LZxRoo5vc0lpCae?=
 =?iso-8859-1?Q?9nrjDPV8PWkPgbqKNEO7YvRGOH4vsUWzaynEJrv6PzZjP9TxDWCet3c9eM?=
 =?iso-8859-1?Q?U68zLy/8wOiJoVNJZ9r2jqC4GLU+9sGNwFrYHZu3prdJdSdSGQoTpXfIyC?=
 =?iso-8859-1?Q?2VDOtZS9YHCMd4uacydyayHC8ali74ZMrfz1Jb+5i1TS/RJQEKpapA/0y3?=
 =?iso-8859-1?Q?Dww49vOwA3Wm/5giADAGxPyZgArEvsoeBVqP/DliwzRw/MFMUFoyLeW0e4?=
 =?iso-8859-1?Q?o6rUKsYGz/gr40WGo8XAk+KIE/t8ncwsyHIwWu2fkrWCBiLCoonTnuzfct?=
 =?iso-8859-1?Q?eEhJqTXl2JrlZHMyITvoSsloOiuXPQZiKTRoLAKGvzB8jEooo0DgYEulcH?=
 =?iso-8859-1?Q?rjebU7swXup/PnVVu2HjuI/P2HgchZtWm9IhA0FF4ku8feL31zBnirX5Wj?=
 =?iso-8859-1?Q?Q7nFTaNOnjxyAWc/cUEMJ19Dja0OCrIPqCnfFRrgiRBKoEw8pRSOOaQyiL?=
 =?iso-8859-1?Q?THOa101fGs7kmMXfXmOztBvxnzIf9/SjblstKAgFkiGj67w/CrfGrvJl36?=
 =?iso-8859-1?Q?P++JyQGAwH/kkFICx0iPimGVtkviT3Kn5X8OQiOr1X2Gs428SqOE1HXI+g?=
 =?iso-8859-1?Q?u8zmxtV3UHQAanEd+Cu/SCBlFisy6smjz6SzFI1JtBMraX62x2qVc8VWPS?=
 =?iso-8859-1?Q?PiRisQE2UJXM2UF5/HH9VmnQZhv31Pi49REKVy3m6jioj/tr1zp3tSOT6K?=
 =?iso-8859-1?Q?SL9rLqSs6vBgchPihFvYnNVcYu0S8kRLyf8vWvU2R7pPY4mysE14bQZRnU?=
 =?iso-8859-1?Q?pikUvIsI6gd/bdJ6en3jpDtyaz7HimIEFSlFwdsA5cY4tiNRSrtwDCYhXh?=
 =?iso-8859-1?Q?vmsCDlW2jxg99dZYgZRENwWeYUOV7YpTbN4Gd9jptauQiDxwYASfGkhtnP?=
 =?iso-8859-1?Q?Fvy7YVNomyrp9zYW/2p5rU9mnAXw5IZmR1B41S3RDhbSmXMFWwdMrW13e9?=
 =?iso-8859-1?Q?l7WqHavHSqQO37j/EGtjs7IFuDHC+Gr03Kao02/ohzI5tfJlVjRPuLgx8I?=
 =?iso-8859-1?Q?5CqfZYIe3DTe6RLzD25RjvXVSJs53TGl5WpVQ9E70ioOsqaSVzdPIyQvJS?=
 =?iso-8859-1?Q?W6bDOmfZijfeaaBUDoR2VuUe6L3J7lI6k948/YPaTGliyCfhNGMN/cuNWk?=
 =?iso-8859-1?Q?Ud3rHHeXSzsl4VKgfCAYDw2gisFXPA32EzNf148qytIS/48ePH0ERVP3Qe?=
 =?iso-8859-1?Q?tvBtSFQMcwgIUV+IFHYhu3mgtGW+ov2kqTl2vX05v/T2O6MKWmYBVmk+6/?=
 =?iso-8859-1?Q?KTT4Glw+xbk+mCZhGeQLVRbybWtReU2JBfdQaEEYf8ECuoEGxLTql+HC4N?=
 =?iso-8859-1?Q?4vDEUXlH3rD9Itl3UFIuc4AHbLrOGQzEdoXuXF+f?=
Content-Type: multipart/alternative;
	boundary="_000_14fc085b1d484bc09d441d11507c0dedbmccom_"
MIME-Version: 1.0
X-OriginatorOrg: bmc.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SA1PR02MB9698.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a311087b-e783-4af1-051e-08dd5c91fa73
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Mar 2025 09:33:39.7897
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92b796c5-5839-40a6-8dd9-c1fad320c69b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 3xQGVEP0JPDcUwFKQ9QasZf+CmnO7R94Bqt52j9kvcVrB3WFSQNUilPgyRMqKd9UVDo/tRiIENbI/pFgitiCCw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR02MB8717
X-Authority-Analysis: v=2.4 cv=HtmMG1TS c=1 sm=1 tr=0 ts=67c96bf7 cx=c_pps a=XJbScVYJ+YTk0JuXi+vtpg==:117 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=wKuvFiaSGQ0qltdbU6+NXLB8nM8=:19 a=Ol13hO9ccFRV9qXi2t6ftBPywas=:19 a=sgbNAxN5YXh6mloA:21 a=xqWC_Br6kY4A:10
 a=Vs1iUdzkB0EA:10 a=uF0kXBFlZFoA:10 a=s2Nz5E0pO3PaKej6VLwA:9 a=wPNLvfGTeEIA:10 a=rqhAXdx7DcE43HN9tFAA:9 a=u2rF6qGs8hWEcMFv:21 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=VYcpXjmDHnEIALPoEwzu:22
X-Proofpoint-GUID: T6ljHbTVz1klPF_GYtzAc3escrMbU5k3
X-Proofpoint-ORIG-GUID: T6ljHbTVz1klPF_GYtzAc3escrMbU5k3
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1093,Hydra:6.0.680,FMLib:17.12.68.34
 definitions=2025-03-06_04,2025-03-06_01,2024-11-22_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501
 suspectscore=0 bulkscore=0 spamscore=0 impostorscore=0 clxscore=1011
 malwarescore=0 phishscore=0 adultscore=0 mlxlogscore=457
 lowpriorityscore=0 mlxscore=0 classifier=spam authscore=0 authtc=n/a
 authcc= route=outbound adjust=0 reason=mlx scancount=1
 engine=8.19.0-2502100000 definitions=main-2503060071
List-Id: <pgsql-general.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-general@lists.postgresql.org>
List-Owner: <mailto:pgsql-general-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-general>
Archived-At: <https://www.postgresql.org/message-id/14fc085b-1d48-4bc0-9d44-1d11507c0ded%40bmc.com>
Precedence: bulk

--_000_14fc085b1d484bc09d441d11507c0dedbmccom_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Explanation.
We have hundreds of pg servers (mainly linux).
App is 7=D724.
We think that patching the server to 15.12.will cost about 30 times more co=
mpared to patching the pg client ( mainly qa effort).
The app working fine using [libpq, psql] on both Linux as well as Windows.
Would love to hear your opinion.
Thanks
Danny


Sent from Workspace ONE Boxer

On Mar 6, 2025 10:11, Laurenz Albe <laurenz.albe@cybertec.at> wrote:
[redirecting to pgsql-general]

On Thu, 2025-03-06 at 07:39 +0000, Abraham, Danny wrote:
> I have many customers using PG 15.3 happily, and I cannot just snap upgra=
de them all to 15.12.

Why do you think you cannot do that?
In the long run, you'll be sorry if you don't.
It is just a matter of replacing the software and restarting the database s=
erver.

> I have tested a nasty trick of replacing PSQL,LIBPQ and several other DLL=
's so that
> I have a PG client 15.12 within the folders of Server 15.3.
>
> All working just fine.
>
> I plan to ship it as a patch - but would like to hear you opinion on this=
 "merge".
>
> (Of course, the next version will use PG 17.4, so this is just an SOS act=
ion).
>
> Directory of C:\Users\dbauser\Desktop\15.12
>
> 02/20/2025  11:48 AM         4,696,576 libcrypto-3-x64.dll
> 02/20/2025  11:48 AM         1,850,401 libiconv-2.dll
> 02/20/2025  11:48 AM           475,769 libintl-9.dll
> 02/20/2025  11:48 AM           323,584 libpq.dll
> 02/20/2025  11:48 AM           779,776 libssl-3-x64.dll
> 02/20/2025  11:48 AM            52,736 libwinpthread-1.dll
> 02/20/2025  11:48 AM           604,160 psql.exe
>
> =3D=3D
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>postgres -V
> postgres (PostgreSQL) 15.3
>
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>psql -V
> psql (PostgreSQL) 15.12

There is nothing fundamentally evil about upgrading the client.

But what is the point?  Why are you worried about client bugs more than
about server bugs?  The latter are much more likely to eat your data.

But then, if you are using Windows, perhaps you don't care a lot about
your data...

Yours,
Laurenz Albe

--_000_14fc085b1d484bc09d441d11507c0dedbmccom_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; pad=
ding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div dir=3D"ltr">Explanation. </div>
<div dir=3D"ltr">We have hundreds of pg servers (mainly linux). </div>
<div dir=3D"ltr">App is 7=D724. </div>
<div dir=3D"ltr">We think that patching the server to 15.12.will cost about=
 30 times more compared to patching the pg client ( mainly qa effort).
</div>
<div dir=3D"ltr">The app working fine using [libpq, psql] on both Linux as =
well as Windows.
</div>
<div dir=3D"ltr">Would love to hear your opinion. </div>
<div dir=3D"ltr">Thanks </div>
<div dir=3D"ltr">Danny </div>
<br>
<br>
<div dir=3D"ltr">Sent from Workspace ONE Boxer </div>
<br>
<div class=3D"x_bx-html">
<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<style>
<!--
.x_EmailQuote
	{margin-left:1pt;
	padding-left:4pt;
	border-left:#800000 2px solid}
-->
</style>
<div class=3D"x_bx-body">
<div class=3D"x_quote">On Mar 6, 2025 10:11, Laurenz Albe &lt;laurenz.albe@=
cybertec.at&gt; wrote:
</div>
</div>
</div>
</div>
<font size=3D"2"><span style=3D"font-size:11pt;">
<div class=3D"PlainText">[redirecting to pgsql-general]<br>
<br>
On Thu, 2025-03-06 at 07:39 +0000, Abraham, Danny wrote:<br>
&gt; I have many customers using PG 15.3 happily, and I cannot just snap up=
grade them all to 15.12.<br>
<br>
Why do you think you cannot do that?<br>
In the long run, you'll be sorry if you don't.<br>
It is just a matter of replacing the software and restarting the database s=
erver.<br>
<br>
&gt; I have tested a nasty trick of replacing PSQL,LIBPQ and several other =
DLL's so that<br>
&gt; I have a PG client 15.12 within the folders of Server 15.3.<br>
&gt; <br>
&gt; All working just fine.<br>
&gt; <br>
&gt; I plan to ship it as a patch - but would like to hear you opinion on t=
his &quot;merge&quot;.<br>
&gt; <br>
&gt; (Of course, the next version will use PG 17.4, so this is just an SOS =
action).<br>
&gt; <br>
&gt; Directory of C:\Users\dbauser\Desktop\15.12<br>
&gt; <br>
&gt; 02/20/2025&nbsp; 11:48 AM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; 4,696,576 libcrypto-3-x64.dll<br>
&gt; 02/20/2025&nbsp; 11:48 AM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; 1,850,401 libiconv-2.dll<br>
&gt; 02/20/2025&nbsp; 11:48 AM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp; 475,769 libintl-9.dll<br>
&gt; 02/20/2025&nbsp; 11:48 AM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp; 323,584 libpq.dll<br>
&gt; 02/20/2025&nbsp; 11:48 AM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp; 779,776 libssl-3-x64.dll<br>
&gt; 02/20/2025&nbsp; 11:48 AM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp; 52,736 libwinpthread-1.dll<br>
&gt; 02/20/2025&nbsp; 11:48 AM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp; 604,160 psql.exe<br>
&gt; <br>
&gt; =3D=3D<br>
&gt; C:\Program Files\BMC Software\Control-M Server\pgsql\bin&gt;postgres -=
V<br>
&gt; postgres (PostgreSQL) 15.3<br>
&gt; <br>
&gt; C:\Program Files\BMC Software\Control-M Server\pgsql\bin&gt;psql -V<br=
>
&gt; psql (PostgreSQL) 15.12<br>
<br>
There is nothing fundamentally evil about upgrading the client.<br>
<br>
But what is the point?&nbsp; Why are you worried about client bugs more tha=
n<br>
about server bugs?&nbsp; The latter are much more likely to eat your data.<=
br>
<br>
But then, if you are using Windows, perhaps you don't care a lot about<br>
your data...<br>
<br>
Yours,<br>
Laurenz Albe<br>
</div>
</span></font>
</body>
</html>

--_000_14fc085b1d484bc09d441d11507c0dedbmccom_--