Date: Sat, 24 Jun 2023 22:11:54 +0000 (UTC)
From: Matthew Reeves <bytemyzer@yahoo.com>
To: "Inoue,Hiroshi" <hinoue205@gmail.com>
Cc: pgsql-odbc@postgresql.org
Message-ID: <2002328551.4654898.1687644714225@mail.yahoo.com>
In-Reply-To: 
 <CAFGcedVJbAAHVmtDnbHaOYcU7kvzUNfsDe--Biw7s6h8koJqtA@mail.gmail.com>
References: 
 <PH0PR11MB512834ECFC2C76179FF5F68A835AA@PH0PR11MB5128.namprd11.prod.outlook.com>
 <CAFGcedVJbAAHVmtDnbHaOYcU7kvzUNfsDe--Biw7s6h8koJqtA@mail.gmail.com>
Subject: Re: psqlODBC drivers 13.2 flagged to be vulnerable for openssl
 1.1.1l vulnerabilities
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_4654897_690635013.1687644714224"
Content-Length: 5014
Archived-At: 
 <https://www.postgresql.org/message-id/2002328551.4654898.1687644714225%40mail.yahoo.com>
Precedence: bulk

------=_Part_4654897_690635013.1687644714224
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

 Hello, Hiroshi,

For the benefit of the group, has a new release been made available yet?
     On Tuesday, June 20, 2023 at 04:52:40 PM PDT, Inoue,Hiroshi <hinoue205=
@gmail.com> wrote: =20
=20
 Hi Miloslav,
Sorry for the late reply.We will make a new release=C2=A0in a few days.Open=
ssl=C2=A03.0.9 version will be used in the release.
regards,Hiroshi Inoue
2023=E5=B9=B46=E6=9C=8814=E6=97=A5(=E6=B0=B4) 23:11 Miloslav Zadrazil <Milo=
slav.Zadrazil@solarwinds.com>:


Hello,=20

=C2=A0

We use your ODBC drivers in our product. During security scans we have rece=
ived warning related to content of psqlODBC 13.2 driver package.

It is flagged to contains OpenSSL 1.1.1lversion vulnerable for CVE-2021-416=
0, CVE-2022-0778, CVE-2022-2097, CVE-2022-4304, CVE-2022-4450, CVE-2023-021=
5, CVE-2023-0286 exposures.

=C2=A0

We must deliver vulnerability analysis to our customers. Can you, please, c=
onfirm that ODBC drivers in version 13.2 are not affected by those exposure=
s ?

=C2=A0

Are there any plans to release additional ODBC driver=E2=80=99s version con=
sidering the fact that openssl 1.x versions are going to be EOF on Septembe=
r 11, 2023 ? =C2=A0

=C2=A0

Many thanks

=C2=A0

Best Regards

=C2=A0

Miloslav Zadrazil

 =20
------=_Part_4654897_690635013.1687644714224
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div>                Hello, Hiroshi,<br><br>For the benefit of the group, h=
as a new release been made available yet?<br>            </div>            =
<div class=3D"yahoo_quoted" style=3D"margin:10px 0px 0px 0.8ex;border-left:=
1px solid #ccc;padding-left:1ex;">                                    <div =
style=3D"font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-si=
ze:13px;color:#26282a;">                                <div>              =
      On Tuesday, June 20, 2023 at 04:52:40 PM PDT, Inoue,Hiroshi &lt;hinou=
e205@gmail.com&gt; wrote:                </div>                <div><br cle=
ar=3D"none"></div>                <div><br clear=3D"none"></div>           =
     <div><div id=3D"yiv9986786656"><div><div dir=3D"ltr">Hi Miloslav,<div>=
<br clear=3D"none"></div><div>Sorry for the late reply.</div><div>We will m=
ake a new release&nbsp;in a few days.</div><div>Openssl&nbsp;3.0.9 version =
will be used in the release.</div><div><br clear=3D"none"></div><div>regard=
s,</div><div>Hiroshi Inoue</div></div><br clear=3D"none"><div class=3D"yiv9=
986786656gmail_quote"><div dir=3D"ltr" class=3D"yiv9986786656gmail_attr">20=
23=E5=B9=B46=E6=9C=8814=E6=97=A5(=E6=B0=B4) 23:11 Miloslav Zadrazil &lt;<a =
rel=3D"nofollow noopener noreferrer" shape=3D"rect" ymailto=3D"mailto:Milos=
lav.Zadrazil@solarwinds.com" target=3D"_blank" href=3D"mailto:Miloslav.Zadr=
azil@solarwinds.com">Miloslav.Zadrazil@solarwinds.com</a>&gt;:<br clear=3D"=
none"></div><div id=3D"yiv9986786656yqt57807" class=3D"yiv9986786656yqt7445=
161616"><blockquote style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex;" class=3D"yiv9986786656gmail_quote"><di=
v class=3D"yiv9986786656msg9036365240937605994"><div lang=3D"EN-US" style=
=3D""><div class=3D"yiv9986786656m_9036365240937605994WordSection1"><p clas=
s=3D"yiv9986786656MsoNormal">Hello, <u></u><u></u></p><p class=3D"yiv998678=
6656MsoNormal"><u></u>&nbsp;<u></u></p><p class=3D"yiv9986786656MsoNormal">=
We use your ODBC drivers in our product. During security scans we have rece=
ived warning related to content of psqlODBC 13.2 driver package.<u></u><u><=
/u></p><p class=3D"yiv9986786656MsoNormal">It is flagged to contains OpenSS=
L 1.1.1lversion vulnerable for CVE-2021-4160, CVE-2022-0778, CVE-2022-2097,=
 CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286 exposures.<u></=
u><u></u></p><p class=3D"yiv9986786656MsoNormal"><u></u>&nbsp;<u></u></p><p=
 class=3D"yiv9986786656MsoNormal">We must deliver vulnerability analysis to=
 our customers. Can you, please, confirm that ODBC drivers in version 13.2 =
are not affected by those exposures ?<u></u><u></u></p><p class=3D"yiv99867=
86656MsoNormal"><u></u>&nbsp;<u></u></p><p class=3D"yiv9986786656MsoNormal"=
>Are there any plans to release additional ODBC driver=E2=80=99s version co=
nsidering the fact that openssl 1.x versions are going to be EOF on Septemb=
er 11, 2023 ? &nbsp;<u></u><u></u></p><p class=3D"yiv9986786656MsoNormal"><=
u></u>&nbsp;<u></u></p><p class=3D"yiv9986786656MsoNormal">Many thanks<u></=
u><u></u></p><p class=3D"yiv9986786656MsoNormal"><u></u>&nbsp;<u></u></p><p=
 class=3D"yiv9986786656MsoNormal">Best Regards<u></u><u></u></p><p class=3D=
"yiv9986786656MsoNormal"><u></u>&nbsp;<u></u></p><p class=3D"yiv9986786656M=
soNormal">Miloslav Zadrazil<u></u><u></u></p></div></div></div></blockquote=
></div></div></div></div></div>            </div>                        </=
div>
------=_Part_4654897_690635013.1687644714224--