public inbox for [email protected]  

help / color / mirror / Atom feed

From: Magnus Hagander <[email protected]>
To: Simon Riggs <[email protected]>
To: Marc G. Fournier <[email protected]>
Cc: [email protected]
Subject: Re: [ANNOUNCE] CRITICAL RELEASE: Minor Releases to Fix DoSVulnerability
Date: Mon, 9 Jan 2006 10:33:02 +0100
Message-ID: <[email protected]> (raw)

> > PostgreSQL patch versions 8.1.2, 8.0.6, 7.4.11 and 7.3.13 are 
> > available today.  The fixes in the 8.1 and 8.0 branches are 
> critical, 
> > especially for Windows users, and users of these branches 
> are urged to 
> > update at their earliest opportunity.
> > 
> > One critical fix repairs a denial-of-service vulnerability: 
> on Windows 
> > only, the postmaster will exit if too many connection 
> requests arrive 
> > simultaneously.  This does not affect existing database 
> connections, 
> > but will prevent new connections from being established until the 
> > postmaster is manually restarted.
> 
> > The Common Vulnerabilities and Exposures (CVE) project has assigned 
> > the name CVE-2006-0105 to this issue.
> 
> No they haven't: there is no such CVE number assigned, nor is 
> there one pending - I just checked. (The numbers don't go 
> that high yet).

Yes, they have. At least according to their own mail ;-) 
It won't show up until the public post is made to bugtraq though. (Or
secunia) And it may be that it hasn't propagated out enough yet, since
it was assigned just this friday.


> [I was looking to update the Security page, but can't find 
> the appropriate refs.]

Already done. Will be on the next update, until then you can find it on
http://magnus-master.pgadmin.org/

//Magnus

view thread (8+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: [ANNOUNCE] CRITICAL RELEASE: Minor Releases to Fix DoSVulnerability
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox