Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.600.62\))
Subject: Re: [BUG] Security bugs affected version detected.
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <CADUHo-UBQcibKmVuFKGh0gMHnacA6TeKdpjOTkKWDwN8f+ECog@mail.gmail.com>
Date: Thu, 29 Aug 2024 15:00:37 +0200
Cc: pgsql-hackers@lists.postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <153AB376-A1F3-4406-B7BB-5677B79939F5@yesql.se>
References: <CADUHo-UBQcibKmVuFKGh0gMHnacA6TeKdpjOTkKWDwN8f+ECog@mail.gmail.com>
To: James Watt <crispy.james.watt@gmail.com>
Archived-At: <https://www.postgresql.org/message-id/153AB376-A1F3-4406-B7BB-5677B79939F5%40yesql.se>
Precedence: bulk

> On 29 Aug 2024, at 14:54, James Watt <crispy.james.watt@gmail.com> =
wrote:
>=20
> Our tool have detected that postgre  in the version of REL9_6_18~ =
REL9_6_24 may also affected by the vulnerability  CVE-2022-2625. The =
vulnerability database does not include these versions and you may not =
fix it in the REL9_6 branch. Is there a need to backport the patch of =
CVE-2022-2625?

9.6 was EOL at the time of 2022-2625 being announced and thus wasn't =
considered
for a backport of the fix, the project only applies fixes to supported
versions.  Anyone still running 9.6 in production is highly recommended =
to
upgrade to a supported version.

--
Daniel Gustafsson