Feedback-ID: i0fe9450f:Fastmail
Date: Tue, 31 Dec 2024 10:23:29 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Bruce Momjian <bruce@momjian.us>
Cc: Roberto =?iso-8859-1?Q?C=2E_S=E1nchez?= <roberto@debian.org>,
	pgsql-hackers@lists.postgresql.org,
	Christoph Berg <myon@debian.org>
Subject: Re: Backport of CVE-2024-10978 fix to older pgsql versions (11, 9.6,
 and 9.4)
Message-ID: <Z3NHkW31MfTaV9u1@paquier.xyz>
References: <Z15D7-HHXweXI2so@localhost>
 <Z3MVlEHp3yNutuHH@localhost>
 <Z3MXgpG64kYxefiG@momjian.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="ywcr7DonEhmF9syF"
Content-Disposition: inline
In-Reply-To: <Z3MXgpG64kYxefiG@momjian.us>
Archived-At: <https://www.postgresql.org/message-id/Z3NHkW31MfTaV9u1%40paquier.xyz>
Precedence: bulk


--ywcr7DonEhmF9syF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Dec 30, 2024 at 04:58:26PM -0500, Bruce Momjian wrote:
> I saw your question and was kind of stumped about how to answer.  We
> rarely look at back branches for backpatch analysis, so I think we are
> kind of confused on how to answer.  Under what circumstances are you
> supported versions of Postgres that we don't support?  Is this part of
> Debian policy?

So am I (I'd say that you are on your own for this one, still..).
It is the first time I hear about that on the lists, but perhaps
Christoph Berg would know better?  Adding him in CC for comments.=20

Applying patches to older branches is a speciality in itself, and
requires a lot of work and analysis (not planning to do that here for
this specific CVE).  The good thing is that 5a2fed911a85 has some
regression tests, so you could be more confident that what you are
doing is rather right.  Now the code in this area has changed slightly
because of the introduction of parallel workers in 9.6, so that could
be tricky.  I'd suggest to *not* bypass the work across multiple
branches at once as it can help in dealing with conflicts in a more
granular way, even if it may increase the analysis burden quite a bit.

While on it, note also 73c9f91a1b6d by the way, which is a follow up
of 5a2fed911a85 for CVE-2024-10978 related to parallel workers, it
would not apply to 9.4, for sure.

> Is our five-year insufficient?

FWIW, I'm already on the side that five-year support is quite good and
I'd side with not extending that, even argue about reducing it
(anti-tomato armor is now on).  Backporting patches across up to 7
branches can be really tedious depending on what you are dealing with
in the backend.
--
Michael

--ywcr7DonEhmF9syF
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmdzR5EACgkQnvQgOdby
QH0Scg//RRJeps6fIzT0C2mr3xNx/WXun+8Jb05D5YMzR/ymfzusUmHbmGaA+/ZF
48Zp/u4hUMJnCoqlV0LhR4VV9P9qgTkGW0+pQbsPiNo0LNE/pS/AhfCJXJDm7RRp
qSsdNXTwqe+I1za0CwzgHS2vrz7mc8jV245KiYkCnVVL9Dem/Y7zwQd0hJE46Dh+
oJyNcTLrWgwmJ8I1RQAPERwDXzcMwy0W16RAaMcDm/Qn5oH6GGmxub9NFRJykkGA
J87l2AvV/4CW93k0H8+SfrX3+2w2vpqTYun5756RWJISKrkOLAsUN0ph1guIfs09
FTrKUvP0Uz3GOaGqNFQ2TodAqhzrd2CKM+dCtFKGLz1Drg74NdtbnbxMhCp6bSOT
2b8PaYWQ7uS3qzPYlN/IfTlZimu+0BNAyPwo14A2czed6KZvkePQpjnu6O4VFXCF
KPy85O6ADkDtf0407mpC9TtrVdN51XubuGmOScjjk/6rItwoqt88pRsg+8RyQtW4
SIw8x9BR8RRv5TFyI6BdlWFEUTRc8MKoxegVJkVeJAP8hamIdgBMSkrqiMKNh9x2
QIWCib+BH2FRsWzYITwaONn1umShM49eJXkriTD7zeYgm6VODRiVEbHGgPtV+tfW
NUhwFJJ2C004MDHFwzzPMV6vTn2VU2+Ce3C2RTHLqUzmoxnHXhs=
=gc1Y
-----END PGP SIGNATURE-----

--ywcr7DonEhmF9syF--