Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: Re: Security information page
Date: Mon, 28 Nov 2005 09:29:24 +0100
Message-ID: <6BCB9D8A16AC4241919521715F4D8BCE6C7C5F@algol.sollentuna.se>
Thread-Topic: [pgsql-www] Security information page
thread-index: AcXzovIchJV735tkTyC+yE0dlMo/IQAUc2xg
From: "Magnus Hagander" <mha@sollentuna.net>
To: "Neil Conway" <neilc@samurai.com>, "Tom Lane" <tgl@sss.pgh.pa.us>
Cc: <pgsql-www@postgresql.org>, "Simon Riggs" <simon@2ndquadrant.com>

> > The list seems a bit short; did you look through the=20
> release notes for=20
> > items that seem to be security issues?  I suspect there are=20
> some that=20
> > don't have CVE names.
>=20
> "Add checks for invalid field length in binary COPY (Tom)" in=20
> 7.4.3, should probably be included.

Yeah. I got that one going through the release notes, had a hard time
finding the actual fix that went along with it to figure out what it
did. Got a reference from Tom now, so I'll add it right away.


> If we're not going to describe issues with 7.2 and earlier=20
> releases (which is probably reasonable), I think we should=20
> back off the claim that "all known" security issues are=20
> listed.

The page clearly says "Please note that versions prior to 7.3 are no
longer supported and vulnerabilities for these versions are not included
in this list". So it should be pretty clear. I'll add something about
them not being fixed either :-)


> Personally I think we shouldn't make the latter=20
> claim, anyway: for example, whether COALESCE(NULL, NULL)=20
> dumping core (fixed in 8.0.3) is a "security issue"
> is often in the eye of the beholder.

If we (the PGDG) beleive that is a security issue, it should be on the
list. And it should be back-patched to other stable branches - has this
been done?


> >From the page:
>=20
> "Our approach covers fail-safe configuration options, a=20
> secure and robust database server as well as good integration=20
> with other security infrastructure software."
>=20
> What "good integration with other security infrastructure"=20
> can PGDG legitimately take credit for?

Um, I dunno really :-) Simon?
I guess the reference to the fact that we publish all required details
for them to scan for it etc...

//Magnus