MIME-Version: 1.0
References: <CAONZJQkaLtHeNz3P5wO8-EWPjOJ1M5fgyp8x4Mc4bb_U9n9_6g@mail.gmail.com>
 <7b5846ac-c16e-48d3-b548-99a772a528c5@aklaver.com> <CAD=40Z3G8z6d1BMDmQVAAPWzCzK5kbU9wWTCZA58qmq8-L=eoA@mail.gmail.com>
 <CAKFQuwbW-5yyVPCjyTJ0uwZZvn9J94s1XzuFnoBbMXp3BC3XyQ@mail.gmail.com>
 <CAD=40Z2+84YNSM7oMb4QBpuAaadk=9XRw3PGEu5Ui_YsWpmtFA@mail.gmail.com>
 <6c898e6499036ce70ac113b52df5c3ff06286a6a.camel@cybertec.at>
 <Z0A6Eg2FH2Nb5sWO@pureos> <Z0IafWDrFln-n0P5@momjian.us>
In-Reply-To: <Z0IafWDrFln-n0P5@momjian.us>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Sat, 23 Nov 2024 15:24:47 -0500
Message-ID: <CANzqJaCph4bT6MQEiDCVROiCQf+jqKKWJowEBqKme-qg83Jzfw@mail.gmail.com>
Subject: Re: CVE-2024-10979 Vulnerability Impact on PostgreSQL 11.10
To: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="00000000000012e40e06279a4b3f"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaCph4bT6MQEiDCVROiCQf%2BjqKKWJowEBqKme-qg83Jzfw%40mail.gmail.com>
Precedence: bulk

--00000000000012e40e06279a4b3f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sat, Nov 23, 2024 at 1:10=E2=80=AFPM Bruce Momjian <bruce@momjian.us> wr=
ote:
[snip]

> I have to admit, for this question, we just point people to:
>
>         https://www.postgresql.org/support/versioning/
>
> and say bounce the database server and install the binaries.  What I
> have never considered before, and I should have, is the complexity of
> doing this for many remote servers.  Can we improve our guidance for
> these cases?
>

What guidance is needed?  Even for us, where firewalls block our servers
from https://download.postgresql.org, it's as simple as downloading the
relevant RPM files *once* (and that done with a PowerShell script), then
patching thusly:

WinScp PG16.4_RHEL8 dir to each server, and on each server
$ sudo -iu postgres pg_ctl stop -mfast -wt9999 -D /path/to/data
$ sudo yum install PG16.4_RHEL8/*rpm
$ sudo -iu postgres pg_ctl start -wt9999 -D /path/to/data

Those three sudo commands take, at most, three minutes.

--
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--00000000000012e40e06279a4b3f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sat, Nov 23, 2024 at 1:10=E2=80=AFPM B=
ruce Momjian &lt;<a href=3D"mailto:bruce@momjian.us">bruce@momjian.us</a>&g=
t; wrote:</div><div class=3D"gmail_quote"><div>[snip]=C2=A0</div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px s=
olid rgb(204,204,204);padding-left:1ex">I have to admit, for this question,=
 we just point people to:<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 <a href=3D"https://www.postgresql.org/support/v=
ersioning/" rel=3D"noreferrer" target=3D"_blank">https://www.postgresql.org=
/support/versioning/</a><br>
<br>
and say bounce the database server and install the binaries.=C2=A0 What I<b=
r>
have never considered before, and I should have, is the complexity of<br>
doing this for many remote servers.=C2=A0 Can we improve our guidance for<b=
r>
these cases?<br></blockquote><div><br></div><div>What guidance is needed?=
=C2=A0 Even for us, where firewalls block our servers from=C2=A0<a href=3D"=
https://download.postgresql.org">https://download.postgresql.org</a>, it=
9;s as simple as downloading=C2=A0the relevant RPM files <i>once</i>=C2=A0(=
and that done with a PowerShell script), then patching thusly:</div><div><b=
r></div><div>WinScp PG16.4_RHEL8 dir to each server, and on each server</di=
v><div>$ sudo -iu postgres pg_ctl stop -mfast -wt9999 -D /path/to/data</div=
><div>$ sudo yum install PG16.4_RHEL8/*rpm</div><div><div>$ sudo -iu postgr=
es pg_ctl start -wt9999 -D /path/to/data</div></div><div><br></div><div>Tho=
se three sudo commands take, at most, three minutes.</div><div><br></div><d=
iv>--</div></div><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr=
">Death to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t boil me, I&#39=
;m still alive.<br><div><div>&lt;Redacted&gt; lobster!</div></div></div></d=
iv></div></div>

--00000000000012e40e06279a4b3f--