Re: a vulnerability in PostgreSQL - Mailing list pgsql-hackers

From Tom Lane
Subject Re: a vulnerability in PostgreSQL
Date
Msg-id 7311.1020349415@sss.pgh.pa.us
Whole thread Raw
In response to a vulnerability in PostgreSQL  (Tatsuo Ishii <t-ishii@sra.co.jp>)
Responses Re: a vulnerability in PostgreSQL  (Lincoln Yeoh <lyeoh@pop.jaring.my>)
Re: a vulnerability in PostgreSQL  (teg@redhat.com (Trond Eivind Glomsrød))
List pgsql-hackers
Tatsuo Ishii <t-ishii@sra.co.jp> writes:
> Here are the precise conditions to trigger the scenario:

> (1) the backend is PostgreSQL 6.5.x
> (2) multibyte support is enabled (--enable-multibyte)
> (3) the database encoding is SQL_ASCII (other encodings are not
>     affected by the bug). 
> (4) the client encoding is set to other than SQL_ASCII

> I think I am responsible for this since I originally wrote the
> code. Sorry for this. I'm going to make back port patches to fix the
> problem for pre 7.2 versions.

It doesn't really seem worth the trouble to make patches for 6.5.x.
If someone hasn't upgraded yet, they aren't likely to install patches
either.  (ISTR there are other known security risks in 6.5, anyway.)
If the problem is fixed in 7.0 and later, why not just tell people to
upgrade?
        regards, tom lane


pgsql-hackers by date:

Previous
From: Oleg Bartunov
Date:
Subject: Re: Schemas: status report, call for developers
Next
From: Jean-Michel POURE
Date:
Subject: Re: PostgreSQL mission statement?