Tom Lane wrote:
>
> Justin Clift <justin@postgresql.org> writes:
> > Hang on, you seem to be suggesting we release a major new upgrade, with
> > major new functionality, knowing it contains a way to trivially crash
> > the backend.
>
> This particular hole has been in *every* release since Postgres 1.01.
How many releases have we known about this and still done a major
release?
> I'm really not interested in responding to any argument that we cannot
> release 7.3 until we have fixed everything that could be labeled a DOS
> threat. 7.3 already contains a bunch of bug fixes; shall we postpone
> releasing those because there are other unfixed bugs?
How trivial are they to exploit?
For example, thinking about something like the various ISP's around who
host PostgreSQL databases; how much effort would it take to fix the
vulnerabilities that let someone with remote access, but no ability to
run a "trusted" language, take out the backend?
Regards and best wishes,
Justin Clift
> regards, tom lane
--
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there." - Indira Gandhi
