MIME-Version: 1.0
From: Daniele Varrazzo <daniele.varrazzo@gmail.com>
Date: Mon, 15 Nov 2021 16:56:10 +0100
Message-ID: 
 <CA+mi_8bgSSnWHwzN=g_Hci2pfzMxyTVjJbXZdb4CyBO+KACz9Q@mail.gmail.com>
Subject: Psycopg 2.9.2, 3.0.4 released
To: Psycopg <psycopg@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000a94bc305d0d5d976"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2Bmi_8bgSSnWHwzN%3Dg_Hci2pfzMxyTVjJbXZdb4CyBO%2BKACz9Q%40mail.gmail.com>
Precedence: bulk

--000000000000a94bc305d0d5d976
Content-Type: text/plain; charset="UTF-8"

Hello,

We have released new versions of both psycopg 2 and 3 packages, addressing
the security issue CVE-2021-23222, affecting the libpq and which has been
resolved in PostgreSQL 14.1 and in the other versions provided in the same
release [1].

The new psycopg releases only solve the problem in the binary packages: if
you install psycopg from source you will need to upgrade the system libpq
library instead.

In order to verify what libpq version your system is using you can query
the functions 'psycopg2.extensions.libpq_version()' [2] and
'psycopg.pq.version()' [3].

Thank you very much!

-- Daniele

[1]:
https://www.postgresql.org/about/news/postgresql-141-135-129-1114-1019-and-9624-released-2349/
[2]:
https://www.psycopg.org/docs/extensions.html#psycopg2.extensions.libpq_version
[3]: https://www.psycopg.org/psycopg3/docs/api/pq.html#psycopg.pq.version

--000000000000a94bc305d0d5d976
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hello,<div dir=3D"auto"><br></div><div dir=3D"auto">We ha=
ve released new versions of both psycopg 2 and 3 packages, addressing the s=
ecurity issue CVE-2021-23222, affecting the libpq and which has been resolv=
ed in PostgreSQL 14.1 and in the other versions provided in the same releas=
e [1].</div><div dir=3D"auto"><br></div><div dir=3D"auto">The new psycopg r=
eleases only solve the problem in the binary packages: if you install psyco=
pg from source you will need to upgrade the system libpq library instead.</=
div><div dir=3D"auto"><br></div><div dir=3D"auto">In order to verify what l=
ibpq version your system is using you can query the functions &#39;psycopg2=
.extensions.libpq_version()&#39; [2] and &#39;psycopg.pq.version()&#39; [3]=
.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Thank you very much!</=
div><div dir=3D"auto"><br></div><div dir=3D"auto">-- Daniele</div><div dir=
=3D"auto"><br></div><div dir=3D"auto">[1]: <a href=3D"https://www.postgresq=
l.org/about/news/postgresql-141-135-129-1114-1019-and-9624-released-2349/">=
https://www.postgresql.org/about/news/postgresql-141-135-129-1114-1019-and-=
9624-released-2349/</a></div><div dir=3D"auto">[2]: <a href=3D"https://www.=
psycopg.org/docs/extensions.html#psycopg2.extensions.libpq_version">https:/=
/www.psycopg.org/docs/extensions.html#psycopg2.extensions.libpq_version</a>=
</div><div dir=3D"auto">[3]: <a href=3D"https://www.psycopg.org/psycopg3/do=
cs/api/pq.html#psycopg.pq.version">https://www.psycopg.org/psycopg3/docs/ap=
i/pq.html#psycopg.pq.version</a></div><div dir=3D"auto"><br></div></div>

--000000000000a94bc305d0d5d976--