Skip site navigation (1) Skip section navigation (2)

Re: [ANNOUNCE] CRITICAL RELEASE: Minor Releases to Fix DoSVulnerability

From: "Magnus Hagander" <mha(at)sollentuna(dot)net>
To: "Simon Riggs" <simon(at)2ndquadrant(dot)com>,"Marc G(dot) Fournier" <scrappy(at)postgresql(dot)org>
Cc: <pgsql-www(at)postgresql(dot)org>
Subject: Re: [ANNOUNCE] CRITICAL RELEASE: Minor Releases to Fix DoSVulnerability
Date: 2006-01-09 09:33:02
Message-ID: 6BCB9D8A16AC4241919521715F4D8BCE6C7E35@algol.sollentuna.se (view raw or flat)
Thread:
Lists: pgsql-www
> > PostgreSQL patch versions 8.1.2, 8.0.6, 7.4.11 and 7.3.13 are 
> > available today.  The fixes in the 8.1 and 8.0 branches are 
> critical, 
> > especially for Windows users, and users of these branches 
> are urged to 
> > update at their earliest opportunity.
> > 
> > One critical fix repairs a denial-of-service vulnerability: 
> on Windows 
> > only, the postmaster will exit if too many connection 
> requests arrive 
> > simultaneously.  This does not affect existing database 
> connections, 
> > but will prevent new connections from being established until the 
> > postmaster is manually restarted.
> 
> > The Common Vulnerabilities and Exposures (CVE) project has assigned 
> > the name CVE-2006-0105 to this issue.
> 
> No they haven't: there is no such CVE number assigned, nor is 
> there one pending - I just checked. (The numbers don't go 
> that high yet).

Yes, they have. At least according to their own mail ;-) 
It won't show up until the public post is made to bugtraq though. (Or
secunia) And it may be that it hasn't propagated out enough yet, since
it was assigned just this friday.


> [I was looking to update the Security page, but can't find 
> the appropriate refs.]

Already done. Will be on the next update, until then you can find it on
http://magnus-master.pgadmin.org/

//Magnus

Responses

pgsql-www by date

Next:From: Simon RiggsDate: 2006-01-09 10:27:01
Subject: Re: [ANNOUNCE] CRITICAL RELEASE: Minor Releases to Fix
Previous:From: Markus BertheauDate: 2006-01-09 09:30:08
Subject: Re: [ANNOUNCE] CRITICAL RELEASE: Minor Releases to Fix DoS

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group