3 ms·

Can someone explain this to me? I've had an issue with Postgres on Debian stable because Postgres had to address a CVE which changed its dump format in a backwa

Can someone explain this to me? I've had an issue with Postgres on Debian stable because Postgres had to address a CVE which changed its dump format in a backwards-incompatible way. This meant that my local Debian on my laptop couldn't load a dump I created on a patched Ubuntu server. Postgres 9.6.8 is the one that fixes this CVE in the 9.6 series. This says the stable package is still vulnerable: https://security-tracker.debian.org/tracker/CVE-2018-1058 https://security-tracker.debian.org/tracker/CVE-2018-1058 But Postgres doesn't show up here: https://security-tracker.debian.org/tracker/status/release/stable https://security-tracker.debian.org/tracker/status/release/s... The 9.6.8 version indeed isn't on stable yet. So is the latter link just buggy? Or is Postgres getting filtered out? Edit: Never mind, after messing with the filter (guess there's no Debian Security Advisory for this CVE), I was able to get Postgres in the second link: https://security-tracker.debian.org/tracker/status/release/stable?filter=1&filter=unassigned_urgency&filter=nodsa https://security-tracker.debian.org/tracker/status/release/s...

eikenberry 9y ago
On that later page, if you check "include issues tagged <no-dsa>" that Postgres issue shows up.
- jordigh 9y ago
  So this has taught me something I didn't know about all Debian: not all CVEs have the same priority or have to be fixed in point releases. Many CVEs don't even get acknowledged by a Debian Security Advisory at all. I guess if I want security to be the utmost priority, I should be using OpenBSD.
  - anarazel 9y ago
    In this case you probably should just be using postgres' apt repository, which'll carry new releases very promptly.
    - jordigh 9y ago
      Kind of the point for me of using Debian is to not have to go shopping around all of the web for packages and because I want to have a uniform packaging standard: Debian Policy. That's why I don't trust anyone but Debian to produce Debian packages. It's a lot of hard work to make sure all packages adhere to a common standard, a standard that upstream distributors will not follow. In this case, however, the Postgres packager is also the Debian packager, so I decided to trust his direct upstream Debian packages and installed them. This is a rare exception, and I don't want to be doing this all the time.
- deleted 9y ago
  [deleted]

eikenberry 9y ago

On that later page, if you check "include issues tagged <no-dsa>" that Postgres issue shows up.

jordigh 9y ago
So this has taught me something I didn't know about all Debian: not all CVEs have the same priority or have to be fixed in point releases. Many CVEs don't even get acknowledged by a Debian Security Advisory at all. I guess if I want security to be the utmost priority, I should be using OpenBSD.
- anarazel 9y ago
  In this case you probably should just be using postgres' apt repository, which'll carry new releases very promptly.
  - jordigh 9y ago
    Kind of the point for me of using Debian is to not have to go shopping around all of the web for packages and because I want to have a uniform packaging standard: Debian Policy. That's why I don't trust anyone but Debian to produce Debian packages. It's a lot of hard work to make sure all packages adhere to a common standard, a standard that upstream distributors will not follow. In this case, however, the Postgres packager is also the Debian packager, so I decided to trust his direct upstream Debian packages and installed them. This is a rare exception, and I don't want to be doing this all the time.
deleted 9y ago
[deleted]