Telegram Group & Telegram Channel
PostgreSQL 的 libpq 函数(如 PQescapeLiteral()PQescapeIdentifier()PQescapeString()PQescapeStringConn())中存在引用语法的不当处理问题,可能导致某些使用场景下的 SQL 注入攻击。具体来说,当应用程序将函数结果用于构建 psql(PostgreSQL 交互终端)的输入时,攻击者可能利用此漏洞进行 SQL 注入。此外,PostgreSQL 命令行工具在 client_encoding 为 BIG5 且 server_encoding 为 EUC_TW 或 MULE_INTERNAL 时,也存在类似的漏洞。受影响的版本包括 PostgreSQL 17.3、16.7、15.11、14.16 和 13.19 之前的版本。

PostgreSQL 项目感谢 Rapid7 的首席安全研究员 Stephen Fewer 报告此问题。

此外,CVE-2025-1094 引入了一个回归问题,并在发布后不久被报告。由于该问题涉及 libpq 且面向客户端,发布团队不确定其影响范围,因此决定在 2025 年 2 月 20 日进行计划外的发布,以尽快修复此问题。根据标准发布流程,所有修复补丁需在 2025 年 2 月 15 日 12:00 UTC 前提交,以确保有足够时间通过构建测试。

参考链接:
[1] https://www.postgresql.org/support/security/CVE-2025-1094/
[2] https://www.postgresql.org/message-id/Z64jD3u46gObCo1p%40pryzbyj2023
[3] https://www.postgresql.org/about/news/out-of-cycle-release-scheduled-for-february-20-2025-3016/
[4] https://www.postgresql.org/developer/roadmap/

#PostgreSQL #SQL注入 #安全漏洞
#AIGC



group-telegram.com/AIGCRubbish/18
Create:
Last Update:

PostgreSQL 的 libpq 函数(如 PQescapeLiteral()PQescapeIdentifier()PQescapeString()PQescapeStringConn())中存在引用语法的不当处理问题,可能导致某些使用场景下的 SQL 注入攻击。具体来说,当应用程序将函数结果用于构建 psql(PostgreSQL 交互终端)的输入时,攻击者可能利用此漏洞进行 SQL 注入。此外,PostgreSQL 命令行工具在 client_encoding 为 BIG5 且 server_encoding 为 EUC_TW 或 MULE_INTERNAL 时,也存在类似的漏洞。受影响的版本包括 PostgreSQL 17.3、16.7、15.11、14.16 和 13.19 之前的版本。

PostgreSQL 项目感谢 Rapid7 的首席安全研究员 Stephen Fewer 报告此问题。

此外,CVE-2025-1094 引入了一个回归问题,并在发布后不久被报告。由于该问题涉及 libpq 且面向客户端,发布团队不确定其影响范围,因此决定在 2025 年 2 月 20 日进行计划外的发布,以尽快修复此问题。根据标准发布流程,所有修复补丁需在 2025 年 2 月 15 日 12:00 UTC 前提交,以确保有足够时间通过构建测试。

参考链接:
[1] https://www.postgresql.org/support/security/CVE-2025-1094/
[2] https://www.postgresql.org/message-id/Z64jD3u46gObCo1p%40pryzbyj2023
[3] https://www.postgresql.org/about/news/out-of-cycle-release-scheduled-for-february-20-2025-3016/
[4] https://www.postgresql.org/developer/roadmap/

#PostgreSQL #SQL注入 #安全漏洞
#AIGC

BY AIGC




Share with your friend now:
group-telegram.com/AIGCRubbish/18

View MORE
Open in Telegram


Telegram | DID YOU KNOW?

Date: |

Recently, Durav wrote on his Telegram channel that users' right to privacy, in light of the war in Ukraine, is "sacred, now more than ever." During the operations, Sebi officials seized various records and documents, including 34 mobile phones, six laptops, four desktops, four tablets, two hard drive disks and one pen drive from the custody of these persons. "Russians are really disconnected from the reality of what happening to their country," Andrey said. "So Telegram has become essential for understanding what's going on to the Russian-speaking world." Investors took profits on Friday while they could ahead of the weekend, explained Tom Essaye, founder of Sevens Report Research. Saturday and Sunday could easily bring unfortunate news on the war front—and traders would rather be able to sell any recent winnings at Friday’s earlier prices than wait for a potentially lower price at Monday’s open. The Security Service of Ukraine said in a tweet that it was able to effectively target Russian convoys near Kyiv because of messages sent to an official Telegram bot account called "STOP Russian War."
from hk


Telegram AIGC
FROM American