public inbox for [email protected]  

help / color / mirror / Atom feed

From: Étienne BERSAC <[email protected]>
To: Peter Eisentraut <[email protected]>
To: Magnus Hagander <[email protected]>
To: Andres Freund <[email protected]>
Cc: Bruce Momjian <[email protected]>
Cc: PostgreSQL-development <[email protected]>
Subject: Re: Security lessons from liblzma - libsystemd
Date: Mon, 08 Apr 2024 12:05:18 +0200
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>
	<CABUevExoimjHPMMpAegci5mX13uOSPbZcWvycbwZwgey3c6P_w@mail.gmail.com>
	<[email protected]>

Hi,

> There are many more interesting and scary libraries in the dependency
> tree of "postgres", so just picking off one right now doesn't really
> accomplish anything.  The next release of libsystemd will drop all
> the compression libraries as hard dependencies, so the issue in that
> sense is gone anyway.  Also, fun fact: liblzma is also a dependency
> via libxml2.

Having an audit of all libraries linked to postgres and their level of
trust should help to point the next weak point. I'm pretty sure we have
several of these tiny libraries maintained by a lone out of time hacker
linked somewhere. What is the next xz ?

Regards,
Étienne 
-- 
DALIBO

view thread (9+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: Security lessons from liblzma - libsystemd
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox