public inbox for [email protected]  

help / color / mirror / Atom feed

From: Bruce Momjian <[email protected]>
To: Roberto C. Sánchez <[email protected]>
Cc: [email protected]
Subject: Re: Backport of CVE-2024-10978 fix to older pgsql versions (11, 9.6, and 9.4)
Date: Mon, 30 Dec 2024 16:58:26 -0500
Message-ID: <[email protected]> (raw)
In-Reply-To: <Z3MVlEHp3yNutuHH@localhost>
References: <Z15D7-HHXweXI2so@localhost>
	<Z3MVlEHp3yNutuHH@localhost>

On Mon, Dec 30, 2024 at 04:50:12PM -0500, Roberto C. Sánchez wrote:
> On Sat, Dec 14, 2024 at 09:50:23PM -0500, Roberto C. Sánchez wrote:
> > Greetings pgsql devs,
> > 
> > I would appreciate a review of my strategy for backporting the commits
> > related to CVE-2024-10978. (I am working with versions 11, 9.6, and 9.4,
> > for some older Debian releases.)
> > 
> > My conclusion is that of the two commits associated with CVE-2024-10978,
> > both are required in 11 and 9.6, but only one is required in 9.4.
> > 
> I wonder if someone might be able to look at my original message and
> help validate my analysis.

I saw your question and was kind of stumped about how to answer.  We
rarely look at back branches for backpatch analysis, so I think we are
kind of confused on how to answer.  Under what circumstances are you
supported versions of Postgres that we don't support?  Is this part of
Debian policy?  Is our five-year insufficient?


-- 
  Bruce Momjian  <[email protected]>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Do not let urgent matters crowd out time for investment in the future.

view thread (10+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: Backport of CVE-2024-10978 fix to older pgsql versions (11, 9.6, and 9.4)
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox