Re: Re[2]: CVE-2022-2625

2022-09-15 Thread Tom Lane
Laurenz Albe writes: > On Thu, 2022-09-15 at 11:19 -0400, Tom Lane wrote: >> I'm a little bemused by your fixation on this particular CVE, >> though. As such things go, it's not a very big deal. > A lot of times, requests like that come from a brainless kind of > institutionalized security: we h

Re: Re[2]: CVE-2022-2625

2022-09-15 Thread Laurenz Albe
On Thu, 2022-09-15 at 11:19 -0400, Tom Lane wrote: > =?UTF-8?B?bWlzaGExOTY2IG1pc2hhMTk2Ng==?= writes: > > Is there a patch for 9.6 ? > > No; that's out of support too. > > I'm a little bemused by your fixation on this particular CVE, > though.  As such things go, it's not a very big deal.  It's

Re: Is it possible to stop sessions killing eachother when they all authorize as the same role?

2022-09-15 Thread Mladen Gogala
On 9/14/22 23:27, Tom Lane wrote: Looks to me like you made the same mistake as Bryn. You revoked the permission in the postgres database: You are right. When I do it correctly, "revoke execute" works. Thanks for taking time to show me the errors of my wicked ways. Regards -- Mladen Gogala

Re: get user info on log

2022-09-15 Thread Adrian Klaver
On 9/13/22 12:45, Marcos Pegoraro wrote: When using set role or set session authorization and an error occurs I get user name which logged in and not the one I´ve changed to. There is a way to get session_user and current_user on log ? When I do: test(5432)=# set role maura; ERROR: role "ma

Re: Mysterious performance degradation in exceptional cases

2022-09-15 Thread Adrian Klaver
On 9/14/22 22:33, Matthias Apitz wrote: El día miércoles, septiembre 14, 2022 a las 07:19:31a. m. -0700, Adrian Klaver escribió: On 9/14/22 01:31, Matthias Apitz wrote: Where is the inter library software, in your application or are you reaching out to another application? The above 'app-

Re: CVE-2022-2625

2022-09-15 Thread Ron
On 9/15/22 10:19, Tom Lane wrote: =?UTF-8?B?bWlzaGExOTY2IG1pc2hhMTk2Ng==?= writes: Is there a patch for 9.6 ? No; that's out of support too. You might find that adapting the v10 patch back to 9.6, and thence to 9.5, would be easier than trying to do it in one step. I'm a little bemused by yo

Re: Re[2]: CVE-2022-2625

2022-09-15 Thread Tom Lane
=?UTF-8?B?bWlzaGExOTY2IG1pc2hhMTk2Ng==?= writes: > Is there a patch for 9.6 ? No; that's out of support too. You might find that adapting the v10 patch back to 9.6, and thence to 9.5, would be easier than trying to do it in one step. I'm a little bemused by your fixation on this particular CVE,

Re: CVE-2022-2625

2022-09-15 Thread Ron
There are nine months of bug fixes. On 9/15/22 09:52, misha1966 misha1966 wrote: Is there a patch for 9.6 ? Четверг, 15 сентября 2022, 17:55 +09:00 от Ron : Software is only certified for 9.5?  Hopefully you're running 9.5.25. I feel your pain... we've got some databases that will

Re: Re[2]: CVE-2022-2625

2022-09-15 Thread Guillaume Lelarge
Le jeu. 15 sept. 2022 à 16:52, misha1966 misha1966 a écrit : > Is there a patch for 9.6 ? > A quick Google search for "postgres CVE-2022-2625" gives you https://www.postgresql.org/support/security/CVE-2022-2625/. And this page tells you there's only a fix for releases 10 to 14. Moreover, fixes i

Re[2]: CVE-2022-2625

2022-09-15 Thread misha1966 misha1966
Is there a patch for 9.6 ?     >Четверг, 15 сентября 2022, 17:55 +09:00 от Ron : >  >Software is only certified for 9.5?  Hopefully you're running 9.5.25. > >I feel your pain... we've got some databases that will stay at 9.6 for another >year. >  >On 9/14/22 23:24, misha1966 misha1966 wrote: >>A

Re[2]: CVE-2022-2625

2022-09-15 Thread misha1966 misha1966
All right :(     >Четверг, 15 сентября 2022, 17:55 +09:00 от Ron : >  >Software is only certified for 9.5?  Hopefully you're running 9.5.25. > >I feel your pain... we've got some databases that will stay at 9.6 for another >year. >  >On 9/14/22 23:24, misha1966 misha1966 wrote: >>All business pr

Re: CVE-2022-2625

2022-09-15 Thread Ron
Software is only certified for 9.5?  Hopefully you're running 9.5.25. I feel your pain... we've got some databases that will stay at 9.6 for another year. On 9/14/22 23:24, misha1966 misha1966 wrote: All business processes are hooked on postgresql 9.5. There is no way to update. Unfortunatel

Re: Resolving host to IP address

2022-09-15 Thread Sebastien Flaesch
Hi! That works for my case now: postgresql.conf: listen_addresses = '0.0.0.0'(only IPv4 is ok for me) pg_hba.conf: hostssl all pgsuser samenet md5 clientcert=verify-ca In /etc/hosts, I still have: 127.0.1.1 toro.strasbourg.4js.com toro But t

Re: Re[2]: CVE-2022-2625

2022-09-15 Thread Laurenz Albe
On Thu, 2022-09-15 at 07:24 +0300, misha1966 misha1966 wrote: > > Четверг, 15 сентября 2022, 1:58 +09:00 от Laurenz Albe > > : > >   > > On Wed, 2022-09-14 at 17:02 +0300, misha1966 misha1966 wrote: > > > Tell me, is there a CVE-2022-2625 vulnerability in posgresql 9.5? > > > If so, who knows how