MIME-Version: 1.0
References: <CAOXzpYDdNrTNE3rj4nvVfvyN=QHdAX6+P7HHR0akkEafxZ6_fw@mail.gmail.com>
 <CAKAnmm+oCJSL=66ES5nQwWu6bF=P5WAyUmxwgLStsbsng5RREg@mail.gmail.com>
In-Reply-To: <CAKAnmm+oCJSL=66ES5nQwWu6bF=P5WAyUmxwgLStsbsng5RREg@mail.gmail.com>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Sat, 12 Jul 2025 10:23:04 -0400
Message-ID: <CANzqJaCxqcwGqjFsWAwbKCvvCJeEpXyshL68gOnmYpFpJeCcRg@mail.gmail.com>
Subject: Re: I have a suspicious query
To: pgsql-general <pgsql-general@postgresql.org>, edmundo@sw-argos.com
Content-Type: multipart/alternative; boundary="000000000000cd5c970639bc2a23"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaCxqcwGqjFsWAwbKCvvCJeEpXyshL68gOnmYpFpJeCcRg%40mail.gmail.com>
Precedence: bulk

--000000000000cd5c970639bc2a23
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Jul 11, 2025 at 2:44=E2=80=AFPM Greg Sabino Mullane <htamfids@gmail=
.com>
wrote:

> Looks like someone testing out the fake Postgres CVE 2019-9193
>
> https://nvd.nist.gov/vuln/detail/CVE-2019-9193
>
> See for example:
>
> https://packetstorm.news/files/id/166540
>
> But certainly the first step is finding out who or what is running this.
>

Next is looking at your pg_hba.conf file.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000cd5c970639bc2a23
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Fri, Jul 11, 2025 at 2:44=E2=80=AFPM G=
reg Sabino Mullane &lt;<a href=3D"mailto:htamfids@gmail.com">htamfids@gmail=
.com</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_container"><=
blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l=
eft:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Looks lik=
e someone testing out the fake Postgres CVE 2019-9193<div><br></div><div><a=
 href=3D"https://nvd.nist.gov/vuln/detail/CVE-2019-9193" target=3D"_blank">=
https://nvd.nist.gov/vuln/detail/CVE-2019-9193</a></div><div><br><div>See f=
or example:</div><div><br></div><div><a href=3D"https://packetstorm.news/fi=
les/id/166540" target=3D"_blank">https://packetstorm.news/files/id/166540</=
a></div><div><br></div><div>But certainly the first step is finding out who=
 or what is running this.</div></div></div></blockquote><div><br></div><div=
>Next is looking at your pg_hba.conf file.</div><div><br></div></div><span =
class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gm=
ail_signature"><div dir=3D"ltr">Death to &lt;Redacted&gt;, and butter sauce=
.<div>Don&#39;t boil me, I&#39;m still alive.<br><div><div>&lt;Redacted&gt;=
 lobster!</div></div></div></div></div></div>

--000000000000cd5c970639bc2a23--