Feedback-ID: i76984098:Fastmail
Message-ID: <906cc022-e33e-4693-ae58-7ecd9f414192@aklaver.com>
Date: Sat, 23 Nov 2024 11:19:09 -0800
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: CVE-2024-10979 Vulnerability Impact on PostgreSQL 11.10
To: Bruce Momjian <bruce@momjian.us>, Greg Sabino Mullane <htamfids@gmail.com>
Cc: Matthias Apitz <guru@unixarea.de>, Laurenz Albe
 <laurenz.albe@cybertec.at>, Subhash Udata <subhashudata@gmail.com>,
 "David G. Johnston" <david.g.johnston@gmail.com>, =?UTF-8?B?6rmA7KO87Jew?=
 <mysylph@gmail.com>,
 "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
References: <CAONZJQkaLtHeNz3P5wO8-EWPjOJ1M5fgyp8x4Mc4bb_U9n9_6g@mail.gmail.com>
 <7b5846ac-c16e-48d3-b548-99a772a528c5@aklaver.com>
 <CAD=40Z3G8z6d1BMDmQVAAPWzCzK5kbU9wWTCZA58qmq8-L=eoA@mail.gmail.com>
 <CAKFQuwbW-5yyVPCjyTJ0uwZZvn9J94s1XzuFnoBbMXp3BC3XyQ@mail.gmail.com>
 <CAD=40Z2+84YNSM7oMb4QBpuAaadk=9XRw3PGEu5Ui_YsWpmtFA@mail.gmail.com>
 <6c898e6499036ce70ac113b52df5c3ff06286a6a.camel@cybertec.at>
 <Z0A6Eg2FH2Nb5sWO@pureos> <Z0IafWDrFln-n0P5@momjian.us>
 <CAKAnmmLHR_WfR0yZhU9c_vT-hTU-T+N84mEvL6tTELoMLvySfw@mail.gmail.com>
 <Z0IljGWKnJCGrC5t@momjian.us>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <Z0IljGWKnJCGrC5t@momjian.us>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/906cc022-e33e-4693-ae58-7ecd9f414192%40aklaver.com>
Precedence: bulk

On 11/23/24 10:57, Bruce Momjian wrote:
> On Sat, Nov 23, 2024 at 01:30:13PM -0500, Greg Sabino Mullane wrote:
>> On Sat, Nov 23, 2024 at 1:10 PM Bruce Momjian <bruce@momjian.us> wrote:
>>
>>      and say bounce the database server and install the binaries.  What I
>>      have never considered before, and I should have, is the complexity of
>>      doing this for many remote servers.  Can we improve our guidance for
>>      these cases?
>>
>>
>> Hmm I'm not sure what else we can say. Our upgrade process is already
>> drop-dead-simple, especially compared to many (most?) other products out there.
>> People painting themselves into corners is not something we can really help
>> with.
> 
> I am wondering if we can highlight which upgrades are most important for
> users who have complex upgrade processes.  Maybe CVEs and corruption
> fixes?

Personally I would point then at:

https://www.postgresql.org/list/pgsql-announce/

and/or:

https://www.postgresql.org/docs/release/

I would think that informs users and let's them determine what is 
important to their situation.


-- 
Adrian Klaver
adrian.klaver@aklaver.com