MIME-Version: 1.0
In-Reply-To: <CAD=40Z2+84YNSM7oMb4QBpuAaadk=9XRw3PGEu5Ui_YsWpmtFA@mail.gmail.com>
References: <CAONZJQkaLtHeNz3P5wO8-EWPjOJ1M5fgyp8x4Mc4bb_U9n9_6g@mail.gmail.com>
 <7b5846ac-c16e-48d3-b548-99a772a528c5@aklaver.com> <CAD=40Z3G8z6d1BMDmQVAAPWzCzK5kbU9wWTCZA58qmq8-L=eoA@mail.gmail.com>
 <CAKFQuwbW-5yyVPCjyTJ0uwZZvn9J94s1XzuFnoBbMXp3BC3XyQ@mail.gmail.com> <CAD=40Z2+84YNSM7oMb4QBpuAaadk=9XRw3PGEu5Ui_YsWpmtFA@mail.gmail.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Thu, 21 Nov 2024 21:51:32 -0700
Message-ID: <CAKFQuwZr=j14Da+n=b8zWERQYBic3iYx0ynTjH3K5Do2=ZLfDw@mail.gmail.com>
Subject: Re: CVE-2024-10979 Vulnerability Impact on PostgreSQL 11.10
To: Subhash Udata <subhashudata@gmail.com>
Cc: Adrian Klaver <adrian.klaver@aklaver.com>, =?UTF-8?B?6rmA7KO87Jew?= <mysylph@gmail.com>, 
	"pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="00000000000016c80a06277923c8"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwZr%3Dj14Da%2Bn%3Db8zWERQYBic3iYx0ynTjH3K5Do2%3DZLfDw%40mail.gmail.com>
Precedence: bulk

--00000000000016c80a06277923c8
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, November 21, 2024, Subhash Udata <subhashudata@gmail.com>
wrote:
>
> Currently, my environment is running *PostgreSQL 15.0*. I understand that
> version *15.9* contains the fix for CVE-2024-10979, as mentioned in the
> release notes.
>
> Given that I am not using the *PL/Perl* extension in my environment
>

IIUC, any user that can execute =E2=80=9Ccreate extension plperl=E2=80=9D i=
n a database
they are connected to (or, it having been installed, users that have been
granted usage on the language) can exploit this vulnerability.  Whether
that is possible in your environment is something you=E2=80=99d need to det=
ermine.

I believe this particular detail probably should have been part of the
release announcement but was not.

In any case if you aren=E2=80=99t willing to update consistently you really
shouldn=E2=80=99t be deploying .0 releases.

David J.

--00000000000016c80a06277923c8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, November 21, 2024, Subhash Udata &lt;<a href=3D"mailto:subhash=
udata@gmail.com">subhashudata@gmail.com</a>&gt; wrote:<blockquote class=3D"=
gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-=
left:1ex"><div dir=3D"ltr"><p>Currently, my environment is running <strong>=
PostgreSQL 15.0</strong>. I understand that version <strong>15.9</strong> c=
ontains the fix for CVE-2024-10979, as mentioned in the release notes.</p><=
p>Given that I am not using the <strong>PL/Perl</strong> extension in my en=
vironment</p></div></blockquote><div><br></div><div>IIUC, any user that can=
 execute =E2=80=9Ccreate extension plperl=E2=80=9D in a database they are c=
onnected to (or, it having been installed, users that have been granted usa=
ge on the language) can exploit this vulnerability.=C2=A0 Whether that is p=
ossible in your environment is something you=E2=80=99d need to determine.</=
div><div><br></div><div>I believe this particular detail probably should ha=
ve been part of the release announcement but was not.</div><div><br></div><=
div>In any case if you aren=E2=80=99t willing to update consistently you re=
ally shouldn=E2=80=99t be deploying .0 releases.</div><div><br></div><div>D=
avid J.</div><div><br></div>

--00000000000016c80a06277923c8--