Message-ID: <b9a4ccd664008a3687103be178e7ed4cb180b9b5.camel@cybertec.at>
Subject: Re: CVE-2024-10979 Vulnerability Impact on PostgreSQL 11.10
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Matthias Apitz <guru@unixarea.de>
Cc: Subhash Udata <subhashudata@gmail.com>, "David G. Johnston"
	 <david.g.johnston@gmail.com>, Adrian Klaver <adrian.klaver@aklaver.com>, 
 =?UTF-8?Q?=EA=B9=80=EC=A3=BC=EC=97=B0?=
	 <mysylph@gmail.com>, "pgsql-general@lists.postgresql.org"
	 <pgsql-general@lists.postgresql.org>
Date: Fri, 22 Nov 2024 16:52:46 +0100
In-Reply-To: <Z0A6Eg2FH2Nb5sWO@pureos>
References: 
	<CAONZJQkaLtHeNz3P5wO8-EWPjOJ1M5fgyp8x4Mc4bb_U9n9_6g@mail.gmail.com>
	 <7b5846ac-c16e-48d3-b548-99a772a528c5@aklaver.com>
	 <CAD=40Z3G8z6d1BMDmQVAAPWzCzK5kbU9wWTCZA58qmq8-L=eoA@mail.gmail.com>
	 <CAKFQuwbW-5yyVPCjyTJ0uwZZvn9J94s1XzuFnoBbMXp3BC3XyQ@mail.gmail.com>
	 <CAD=40Z2+84YNSM7oMb4QBpuAaadk=9XRw3PGEu5Ui_YsWpmtFA@mail.gmail.com>
	 <6c898e6499036ce70ac113b52df5c3ff06286a6a.camel@cybertec.at>
	 <Z0A6Eg2FH2Nb5sWO@pureos>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.52.4 (3.52.4-2.fc40) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/b9a4ccd664008a3687103be178e7ed4cb180b9b5.camel%40cybertec.at>
Precedence: bulk

On Fri, 2024-11-22 at 09:00 +0100, Matthias Apitz wrote:
> > > Given that I am not using the PL/Perl extension in my environment, I =
wanted to ask:
> > > =C2=A0* Is it still mandatory to upgrade specifically to version 15.9=
, or would
> > > =C2=A0=C2=A0=C2=A0 remaining on version 15.0 suffice in this case?
> > > I appreciate your guidance on whether this upgrade is necessary, cons=
idering the
> > > specifics of my setup.
> >=20
> > If you don't use PL/Perl, you are not affected by that security vulnera=
bility.
> >=20
> > I wonder what you mean by "mandatory".
> >=20
> > We won't fine or punish you if you don't update PostgreSQL, but perhaps=
 it
> > would make your employer unhappy.=C2=A0 If you stay on 15.0, you will b=
e subject to
> > thirteen other security vulnerabilities (if I counted right), and you m=
ay end
> > up with corrupted GIN and BRIN indexes.=C2=A0 Additionally, you will be=
 subject to
> > countless known bugs that have been fixed since.
> >=20
> > You should *always* update to the latest minor release shortly after it=
 is
> > released.=C2=A0 Everything else is negligent.
>=20
> The company I'm working for is producer of a Library Management System
> with C/C++ written servers on Linux, using ESQL/C and DBI interfaces of
> PostgreSQL (and older version Sybase too) and the software is deployed
> to 100++ customer installations, sometimes with limited own IT know how.

And you didn't plan how you intend to ship software updates to these
customers?

> "You should *always* update ..." is nice to say, but in the described lan=
d
> not easy to do.

If you say so.  Still, that is a problem that will come to bite you
some day, as soon as your customers hit some PostgreSQL bug.

> I assume that=20
> CVE-2024-10979 affects the server side, and not the client side.

Right.  I wonder why you are so keen on that vulnerability and ignore
all the others discovered since 15.0.

> Any further comments on this?

No.  I told you that you should update, and you explained in great
detail why you cannot.  There is nothing more to say.  Good luck.

Yours,
Laurenz Albe