Thread: Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i
[redirecting to pgsql-general] On Thu, 2025-03-06 at 07:39 +0000, Abraham, Danny wrote: > I have many customers using PG 15.3 happily, and I cannot just snap upgrade them all to 15.12. Why do you think you cannot do that? In the long run, you'll be sorry if you don't. It is just a matter of replacing the software and restarting the database server. > I have tested a nasty trick of replacing PSQL,LIBPQ and several other DLL's so that > I have a PG client 15.12 within the folders of Server 15.3. > > All working just fine. > > I plan to ship it as a patch - but would like to hear you opinion on this "merge". > > (Of course, the next version will use PG 17.4, so this is just an SOS action). > > Directory of C:\Users\dbauser\Desktop\15.12 > > 02/20/2025 11:48 AM 4,696,576 libcrypto-3-x64.dll > 02/20/2025 11:48 AM 1,850,401 libiconv-2.dll > 02/20/2025 11:48 AM 475,769 libintl-9.dll > 02/20/2025 11:48 AM 323,584 libpq.dll > 02/20/2025 11:48 AM 779,776 libssl-3-x64.dll > 02/20/2025 11:48 AM 52,736 libwinpthread-1.dll > 02/20/2025 11:48 AM 604,160 psql.exe > > == > C:\Program Files\BMC Software\Control-M Server\pgsql\bin>postgres -V > postgres (PostgreSQL) 15.3 > > C:\Program Files\BMC Software\Control-M Server\pgsql\bin>psql -V > psql (PostgreSQL) 15.12 There is nothing fundamentally evil about upgrading the client. But what is the point? Why are you worried about client bugs more than about server bugs? The latter are much more likely to eat your data. But then, if you are using Windows, perhaps you don't care a lot about your data... Yours, Laurenz Albe
On Thu, Mar 6, 2025 at 3:12 AM Laurenz Albe <laurenz.albe@cybertec.at> wrote:
[redirecting to pgsql-general]
On Thu, 2025-03-06 at 07:39 +0000, Abraham, Danny wrote:
> I have many customers using PG 15.3 happily, and I cannot just snap upgrade them all to 15.12.
Why do you think you cannot do that?
In the long run, you'll be sorry if you don't.
It is just a matter of replacing the software and restarting the database server.
It really is that simple. On Linux, at least, it takes me less than two minutes to:
1. Pause streaming replication between 2 nodes.
2. Stop PG on both nodes.
3. Install the new software.
4. Start PG on both nodes.
5. Resume streaming replication.
That's using PowerShell to do everything; a noticeable part of that 110 seconds is the ssh overhead of logging in and out of servers over our network, and even more is taken up by me scanning for errors between each step, and then pasting the next set of commands.
If all your database servers are Windows, then the PS to stop, install and start on a remote node should be even faster (especially if you don't have replication).
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!
Re: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i
From
"Abraham, Danny"
Date:
Explanation.
We have hundreds of pg servers (mainly linux).
App is 7×24.
We think that patching the server to 15.12.will cost about 30 times more compared to patching the pg client ( mainly qa effort).
The app working fine using [libpq, psql] on both Linux as well as Windows.
Would love to hear your opinion.
Thanks
Danny
Sent from Workspace ONE Boxer
On Mar 6, 2025 10:11, Laurenz Albe <laurenz.albe@cybertec.at> wrote:
[redirecting to pgsql-general]
On Thu, 2025-03-06 at 07:39 +0000, Abraham, Danny wrote:
> I have many customers using PG 15.3 happily, and I cannot just snap upgrade them all to 15.12.
Why do you think you cannot do that?
In the long run, you'll be sorry if you don't.
It is just a matter of replacing the software and restarting the database server.
> I have tested a nasty trick of replacing PSQL,LIBPQ and several other DLL's so that
> I have a PG client 15.12 within the folders of Server 15.3.
>
> All working just fine.
>
> I plan to ship it as a patch - but would like to hear you opinion on this "merge".
>
> (Of course, the next version will use PG 17.4, so this is just an SOS action).
>
> Directory of C:\Users\dbauser\Desktop\15.12
>
> 02/20/2025 11:48 AM 4,696,576 libcrypto-3-x64.dll
> 02/20/2025 11:48 AM 1,850,401 libiconv-2.dll
> 02/20/2025 11:48 AM 475,769 libintl-9.dll
> 02/20/2025 11:48 AM 323,584 libpq.dll
> 02/20/2025 11:48 AM 779,776 libssl-3-x64.dll
> 02/20/2025 11:48 AM 52,736 libwinpthread-1.dll
> 02/20/2025 11:48 AM 604,160 psql.exe
>
> ==
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>postgres -V
> postgres (PostgreSQL) 15.3
>
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>psql -V
> psql (PostgreSQL) 15.12
There is nothing fundamentally evil about upgrading the client.
But what is the point? Why are you worried about client bugs more than
about server bugs? The latter are much more likely to eat your data.
But then, if you are using Windows, perhaps you don't care a lot about
your data...
Yours,
Laurenz Albe
On Thu, 2025-03-06 at 07:39 +0000, Abraham, Danny wrote:
> I have many customers using PG 15.3 happily, and I cannot just snap upgrade them all to 15.12.
Why do you think you cannot do that?
In the long run, you'll be sorry if you don't.
It is just a matter of replacing the software and restarting the database server.
> I have tested a nasty trick of replacing PSQL,LIBPQ and several other DLL's so that
> I have a PG client 15.12 within the folders of Server 15.3.
>
> All working just fine.
>
> I plan to ship it as a patch - but would like to hear you opinion on this "merge".
>
> (Of course, the next version will use PG 17.4, so this is just an SOS action).
>
> Directory of C:\Users\dbauser\Desktop\15.12
>
> 02/20/2025 11:48 AM 4,696,576 libcrypto-3-x64.dll
> 02/20/2025 11:48 AM 1,850,401 libiconv-2.dll
> 02/20/2025 11:48 AM 475,769 libintl-9.dll
> 02/20/2025 11:48 AM 323,584 libpq.dll
> 02/20/2025 11:48 AM 779,776 libssl-3-x64.dll
> 02/20/2025 11:48 AM 52,736 libwinpthread-1.dll
> 02/20/2025 11:48 AM 604,160 psql.exe
>
> ==
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>postgres -V
> postgres (PostgreSQL) 15.3
>
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>psql -V
> psql (PostgreSQL) 15.12
There is nothing fundamentally evil about upgrading the client.
But what is the point? Why are you worried about client bugs more than
about server bugs? The latter are much more likely to eat your data.
But then, if you are using Windows, perhaps you don't care a lot about
your data...
Yours,
Laurenz Albe
Re: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i
From
Ron Johnson
Date:
Since it's a 24x7 app, you have database replication, virtual IPs and a fail-over manager in case a server crashes?
Anyway, read through the PG 15 release notes. If none really affect you, then stay on 15.3. You're certain to miss something, though, or not understand the ramifications. And besides, there are always security patches in them.
On Thu, Mar 6, 2025 at 4:33 AM Abraham, Danny <danny_abraham@bmc.com> wrote:
Explanation.We have hundreds of pg servers (mainly linux).App is 7×24.We think that patching the server to 15.12.will cost about 30 times more compared to patching the pg client ( mainly qa effort).The app working fine using [libpq, psql] on both Linux as well as Windows.Would love to hear your opinion.ThanksDannySent from Workspace ONE BoxerOn Mar 6, 2025 10:11, Laurenz Albe <laurenz.albe@cybertec.at> wrote:[redirecting to pgsql-general]
On Thu, 2025-03-06 at 07:39 +0000, Abraham, Danny wrote:
> I have many customers using PG 15.3 happily, and I cannot just snap upgrade them all to 15.12.
Why do you think you cannot do that?
In the long run, you'll be sorry if you don't.
It is just a matter of replacing the software and restarting the database server.
> I have tested a nasty trick of replacing PSQL,LIBPQ and several other DLL's so that
> I have a PG client 15.12 within the folders of Server 15.3.
>
> All working just fine.
>
> I plan to ship it as a patch - but would like to hear you opinion on this "merge".
>
> (Of course, the next version will use PG 17.4, so this is just an SOS action).
>
> Directory of C:\Users\dbauser\Desktop\15.12
>
> 02/20/2025 11:48 AM 4,696,576 libcrypto-3-x64.dll
> 02/20/2025 11:48 AM 1,850,401 libiconv-2.dll
> 02/20/2025 11:48 AM 475,769 libintl-9.dll
> 02/20/2025 11:48 AM 323,584 libpq.dll
> 02/20/2025 11:48 AM 779,776 libssl-3-x64.dll
> 02/20/2025 11:48 AM 52,736 libwinpthread-1.dll
> 02/20/2025 11:48 AM 604,160 psql.exe
>
> ==
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>postgres -V
> postgres (PostgreSQL) 15.3
>
> C:\Program Files\BMC Software\Control-M Server\pgsql\bin>psql -V
> psql (PostgreSQL) 15.12
There is nothing fundamentally evil about upgrading the client.
But what is the point? Why are you worried about client bugs more than
about server bugs? The latter are much more likely to eat your data.
But then, if you are using Windows, perhaps you don't care a lot about
your data...
Yours,
Laurenz Albe
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!
Re: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i
From
Laurenz Albe
Date:
On Thu, 2025-03-06 at 09:33 +0000, Abraham, Danny wrote: > We have hundreds of pg servers (mainly linux). > App is 7×24. > We think that patching the server to 15.12.will cost about 30 times > more compared to patching the pg client ( mainly qa effort). I don't think so. Don't do any QA when installing a PostgreSQL patch (just roll it out on the test systems first to see if your installation procedure works). Down time because of data corruption will cost *way* more than patching. Yours, Laurenz Albe
Re: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i
From
Greg Sabino Mullane
Date:
CVE-2025-1094 has a narrow blast radius. If you are not directly affected, I would focus your efforts on getting to 17. But the lack of an existing process to smoothly upgrade minor revisions is worrying and something that needs to get addressed as well.
Cheers,
Greg
--
Crunchy Data - https://www.crunchydata.com
Enterprise Postgres Software Products & Tech Support
Greg
--
Crunchy Data - https://www.crunchydata.com
Enterprise Postgres Software Products & Tech Support