Rendered at 07:26:53 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ianberdin 3 days ago [-]
Looking at all these security patches reminded me of when I was a kid and I thoroughly cleaned my apartment, wiped away every bit of dust in every single crevice, and then a couple of days later it was all back again. And I thought: am I really going to be doing this my whole life?
rglover 3 days ago [-]
Narrator: yes.
firer 3 days ago [-]
All of these seem to be post-auth, except for CVE-2026-116322 (which doesn't grant code execution, "only" a DoS).
About a year ago I found and exploited CVE-2026-2004, which is also a Postgres post-auth RCE, as part of Wiz's zeroday.cloud competition.
I choose that target because it immediately stood out as highly complex with lots of user input. In my opinion, it's a bad idea to define this as a security boundary in the first place. Access to a database can very likely lead to code execution - there's way too much attack surface.
Most serious cloud providers rightly sandbox their DB offerings exactly for this reason. And this year's zeroday.cloud competition no longer has authenticated Postgres as a target, exactly for this reason.
lfittl 3 days ago [-]
FWIW, I found it easier to look at the release notes (https://www.postgresql.org/docs/release/18.7/) to understand the overall scope of the CVEs - from the announcement the individual CVE pages are linked, but its hard to scan.
zulux 3 days ago [-]
Mega patches like this, in my opinion, should be treated as mandatory patches. If I were trying to get a significant security update into the field in the age of LLM drama, this is how I would do it.
levkk 3 days ago [-]
Most databases run offline and don't allow arbitrary SQL statements. SQL injections are generally eliminated by using the extended protocol.
So, yes, if you're running multi-tenant Postgres as a public service, you should upgrade. Everyone else is in no rush.
perlgeek 3 days ago [-]
No rush, but don't wait too long either.
Yes, the application above it should prevent SQL injection, but if it's imperfect, you don't want an attacker to turn SQL injection into RCE.
mistrial9 3 days ago [-]
Debian Trixie just included quite a lot, when asking only for specific updates. I think your wish has been granted
fock 3 days ago [-]
then, what would you do if you were an adversary trying to push your xz-style vulnerability to every place known to man?
ltbarcly3 3 days ago [-]
So you're in favor of applying security patches? Controversial opinion.
ejazarain 2 days ago [-]
The benefit of AI testing security has exposed every app out there and the vulnerabilities that hid for years are revealing them so quickly and so accurately that has shaken everyone for good and fixing them will definitely make the data safer.
Well done PG community for being quick to respond.
at least i can go and sleep as i used to sleep :)
conradfr 2 days ago [-]
What is the usual delay for the official Docker image update?
wbrd 2 days ago [-]
They are out now.
simonw 3 days ago [-]
"This release fixes 52 security vulnerabilities and over 140 bugs reported over the last several months."
sick_of_slop 3 days ago [-]
FINALLY
Been waiting for this for timezone info updates for Northwestern Ontario and Manitoba making Daylight Savings permanent, which wreaked havoc on our customers since the first.
We have mitigations in place but they aren’t perfect, looking forward to getting this out ASAP.
To be clear - I blame the government for making the change on such short notice. Ontario got like 2 weeks notice. Nowhere near enough time to prepare.
alvherre 15 hours ago [-]
Note that if your packaging uses the system's timezone files, you don't need to wait for a new Postgres release.
About a year ago I found and exploited CVE-2026-2004, which is also a Postgres post-auth RCE, as part of Wiz's zeroday.cloud competition.
I choose that target because it immediately stood out as highly complex with lots of user input. In my opinion, it's a bad idea to define this as a security boundary in the first place. Access to a database can very likely lead to code execution - there's way too much attack surface.
Most serious cloud providers rightly sandbox their DB offerings exactly for this reason. And this year's zeroday.cloud competition no longer has authenticated Postgres as a target, exactly for this reason.
So, yes, if you're running multi-tenant Postgres as a public service, you should upgrade. Everyone else is in no rush.
Yes, the application above it should prevent SQL injection, but if it's imperfect, you don't want an attacker to turn SQL injection into RCE.
Well done PG community for being quick to respond.
at least i can go and sleep as i used to sleep :)
Been waiting for this for timezone info updates for Northwestern Ontario and Manitoba making Daylight Savings permanent, which wreaked havoc on our customers since the first.
We have mitigations in place but they aren’t perfect, looking forward to getting this out ASAP.
To be clear - I blame the government for making the change on such short notice. Ontario got like 2 weeks notice. Nowhere near enough time to prepare.