Re: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i

2025-03-08 Thread Ron Johnson
Since it's a 24x7 app, you have database replication, virtual IPs and a fail-over manager in case a server crashes? Anyway, read through the PG 15 release notes. If none really affect you, then stay on 15.3. You're certain to miss *something*, though, or not understand the ramifications. And be

Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i

2025-03-08 Thread Ron Johnson
On Thu, Mar 6, 2025 at 3:12 AM Laurenz Albe wrote: > [redirecting to pgsql-general] > > On Thu, 2025-03-06 at 07:39 +, Abraham, Danny wrote: > > I have many customers using PG 15.3 happily, and I cannot just snap > upgrade them all to 15.12. > > Why do you think you cannot do that? > In the l

Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i

2025-03-07 Thread Laurenz Albe
[redirecting to pgsql-general] On Thu, 2025-03-06 at 07:39 +, Abraham, Danny wrote: > I have many customers using PG 15.3 happily, and I cannot just snap upgrade > them all to 15.12. Why do you think you cannot do that? In the long run, you'll be sorry if you don't. It is just a matter of re

Re: [EXTERNAL] Re: Asking for OK for a nasty trick to resolve PG CVE-2025-1094 i

2025-03-07 Thread Greg Sabino Mullane
CVE-2025-1094 has a narrow blast radius. If you are not directly affected, I would focus your efforts on getting to 17. But the lack of an existing process to smoothly upgrade minor revisions is worrying and something that needs to get addressed as well. Cheers, Greg -- Crunchy Data - https://www