Re: postgresql command line exploit found in the wild - Mailing list pgsql-general

From Daniel Verite
Subject Re: postgresql command line exploit found in the wild
Date
Msg-id cd81d201-e9fa-4567-ac49-e3e762935747@mm
Whole thread Raw
In response to postgresql command line exploit found in the wild  (Merlin Moncure <mmoncure@gmail.com>)
Responses Re: postgresql command line exploit found in the wild
Re: postgresql command line exploit found in the wild
List pgsql-general
    Merlin Moncure wrote:

> if you have an internet facing database, patch it immediately!

By the way:

People running 9.1 on debian stable (squeeze) typically use this package:
http://packages.debian.org/squeeze-backports/postgresql-9.1

Currently, it looks like the fix is only available in pre-compiled form for
the amd64 architecture (see the bottom of the page). All other archs
including the popular i386 are stuck at version: 9.1.7-1~bpo60+1

I find it problematic. One can always switch to the new apt.postgresql.org
repository that has the latest versions, but how many people are going to not
even notice the problem, trusting their normal upgrade path?

Best regards,
--
Daniel
PostgreSQL-powered mail user agent and storage: http://www.manitou-mail.org


pgsql-general by date:

Previous
From: Shaun Thomas
Date:
Subject: Re: Backup advice
Next
From: Merlin Moncure
Date:
Subject: Re: postgresql command line exploit found in the wild