Telegram Group & Telegram Channel
PostgreSQL 的 libpq 函数(如 PQescapeLiteral()PQescapeIdentifier()PQescapeString()PQescapeStringConn())中存在引用语法的不当处理问题,可能导致某些使用场景下的 SQL 注入攻击。具体来说,当应用程序将函数结果用于构建 psql(PostgreSQL 交互终端)的输入时,攻击者可能利用此漏洞进行 SQL 注入。此外,PostgreSQL 命令行工具在 client_encoding 为 BIG5 且 server_encoding 为 EUC_TW 或 MULE_INTERNAL 时,也存在类似的漏洞。受影响的版本包括 PostgreSQL 17.3、16.7、15.11、14.16 和 13.19 之前的版本。

PostgreSQL 项目感谢 Rapid7 的首席安全研究员 Stephen Fewer 报告此问题。

此外,CVE-2025-1094 引入了一个回归问题,并在发布后不久被报告。由于该问题涉及 libpq 且面向客户端,发布团队不确定其影响范围,因此决定在 2025 年 2 月 20 日进行计划外的发布,以尽快修复此问题。根据标准发布流程,所有修复补丁需在 2025 年 2 月 15 日 12:00 UTC 前提交,以确保有足够时间通过构建测试。

参考链接:
[1] https://www.postgresql.org/support/security/CVE-2025-1094/
[2] https://www.postgresql.org/message-id/Z64jD3u46gObCo1p%40pryzbyj2023
[3] https://www.postgresql.org/about/news/out-of-cycle-release-scheduled-for-february-20-2025-3016/
[4] https://www.postgresql.org/developer/roadmap/

#PostgreSQL #SQL注入 #安全漏洞
#AIGC



group-telegram.com/AIGCRubbish/18
Create:
Last Update:

PostgreSQL 的 libpq 函数(如 PQescapeLiteral()PQescapeIdentifier()PQescapeString()PQescapeStringConn())中存在引用语法的不当处理问题,可能导致某些使用场景下的 SQL 注入攻击。具体来说,当应用程序将函数结果用于构建 psql(PostgreSQL 交互终端)的输入时,攻击者可能利用此漏洞进行 SQL 注入。此外,PostgreSQL 命令行工具在 client_encoding 为 BIG5 且 server_encoding 为 EUC_TW 或 MULE_INTERNAL 时,也存在类似的漏洞。受影响的版本包括 PostgreSQL 17.3、16.7、15.11、14.16 和 13.19 之前的版本。

PostgreSQL 项目感谢 Rapid7 的首席安全研究员 Stephen Fewer 报告此问题。

此外,CVE-2025-1094 引入了一个回归问题,并在发布后不久被报告。由于该问题涉及 libpq 且面向客户端,发布团队不确定其影响范围,因此决定在 2025 年 2 月 20 日进行计划外的发布,以尽快修复此问题。根据标准发布流程,所有修复补丁需在 2025 年 2 月 15 日 12:00 UTC 前提交,以确保有足够时间通过构建测试。

参考链接:
[1] https://www.postgresql.org/support/security/CVE-2025-1094/
[2] https://www.postgresql.org/message-id/Z64jD3u46gObCo1p%40pryzbyj2023
[3] https://www.postgresql.org/about/news/out-of-cycle-release-scheduled-for-february-20-2025-3016/
[4] https://www.postgresql.org/developer/roadmap/

#PostgreSQL #SQL注入 #安全漏洞
#AIGC

BY AIGC




Share with your friend now:
group-telegram.com/AIGCRubbish/18

View MORE
Open in Telegram


Telegram | DID YOU KNOW?

Date: |

These administrators had built substantial positions in these scrips prior to the circulation of recommendations and offloaded their positions subsequent to rise in price of these scrips, making significant profits at the expense of unsuspecting investors, Sebi noted. Russian President Vladimir Putin launched Russia's invasion of Ukraine in the early-morning hours of February 24, targeting several key cities with military strikes. The Security Service of Ukraine said in a tweet that it was able to effectively target Russian convoys near Kyiv because of messages sent to an official Telegram bot account called "STOP Russian War." The news also helped traders look past another report showing decades-high inflation and shake off some of the volatility from recent sessions. The Bureau of Labor Statistics' February Consumer Price Index (CPI) this week showed another surge in prices even before Russia escalated its attacks in Ukraine. The headline CPI — soaring 7.9% over last year — underscored the sticky inflationary pressures reverberating across the U.S. economy, with everything from groceries to rents and airline fares getting more expensive for everyday consumers. Telegram was co-founded by Pavel and Nikolai Durov, the brothers who had previously created VKontakte. VK is Russia’s equivalent of Facebook, a social network used for public and private messaging, audio and video sharing as well as online gaming. In January, SimpleWeb reported that VK was Russia’s fourth most-visited website, after Yandex, YouTube and Google’s Russian-language homepage. In 2016, Forbes’ Michael Solomon described Pavel Durov (pictured, below) as the “Mark Zuckerberg of Russia.”
from us


Telegram AIGC
FROM American