Telegram Group & Telegram Channel
PostgreSQL 的 libpq 函数(如 PQescapeLiteral()PQescapeIdentifier()PQescapeString()PQescapeStringConn())中存在引用语法的不当处理问题,可能导致某些使用场景下的 SQL 注入攻击。具体来说,当应用程序将函数结果用于构建 psql(PostgreSQL 交互终端)的输入时,攻击者可能利用此漏洞进行 SQL 注入。此外,PostgreSQL 命令行工具在 client_encoding 为 BIG5 且 server_encoding 为 EUC_TW 或 MULE_INTERNAL 时,也存在类似的漏洞。受影响的版本包括 PostgreSQL 17.3、16.7、15.11、14.16 和 13.19 之前的版本。

PostgreSQL 项目感谢 Rapid7 的首席安全研究员 Stephen Fewer 报告此问题。

此外,CVE-2025-1094 引入了一个回归问题,并在发布后不久被报告。由于该问题涉及 libpq 且面向客户端,发布团队不确定其影响范围,因此决定在 2025 年 2 月 20 日进行计划外的发布,以尽快修复此问题。根据标准发布流程,所有修复补丁需在 2025 年 2 月 15 日 12:00 UTC 前提交,以确保有足够时间通过构建测试。

参考链接:
[1] https://www.postgresql.org/support/security/CVE-2025-1094/
[2] https://www.postgresql.org/message-id/Z64jD3u46gObCo1p%40pryzbyj2023
[3] https://www.postgresql.org/about/news/out-of-cycle-release-scheduled-for-february-20-2025-3016/
[4] https://www.postgresql.org/developer/roadmap/

#PostgreSQL #SQL注入 #安全漏洞
#AIGC



group-telegram.com/AIGCRubbish/18
Create:
Last Update:

PostgreSQL 的 libpq 函数(如 PQescapeLiteral()PQescapeIdentifier()PQescapeString()PQescapeStringConn())中存在引用语法的不当处理问题,可能导致某些使用场景下的 SQL 注入攻击。具体来说,当应用程序将函数结果用于构建 psql(PostgreSQL 交互终端)的输入时,攻击者可能利用此漏洞进行 SQL 注入。此外,PostgreSQL 命令行工具在 client_encoding 为 BIG5 且 server_encoding 为 EUC_TW 或 MULE_INTERNAL 时,也存在类似的漏洞。受影响的版本包括 PostgreSQL 17.3、16.7、15.11、14.16 和 13.19 之前的版本。

PostgreSQL 项目感谢 Rapid7 的首席安全研究员 Stephen Fewer 报告此问题。

此外,CVE-2025-1094 引入了一个回归问题,并在发布后不久被报告。由于该问题涉及 libpq 且面向客户端,发布团队不确定其影响范围,因此决定在 2025 年 2 月 20 日进行计划外的发布,以尽快修复此问题。根据标准发布流程,所有修复补丁需在 2025 年 2 月 15 日 12:00 UTC 前提交,以确保有足够时间通过构建测试。

参考链接:
[1] https://www.postgresql.org/support/security/CVE-2025-1094/
[2] https://www.postgresql.org/message-id/Z64jD3u46gObCo1p%40pryzbyj2023
[3] https://www.postgresql.org/about/news/out-of-cycle-release-scheduled-for-february-20-2025-3016/
[4] https://www.postgresql.org/developer/roadmap/

#PostgreSQL #SQL注入 #安全漏洞
#AIGC

BY AIGC




Share with your friend now:
group-telegram.com/AIGCRubbish/18

View MORE
Open in Telegram


Telegram | DID YOU KNOW?

Date: |

Pavel Durov, Telegram's CEO, is known as "the Russian Mark Zuckerberg," for co-founding VKontakte, which is Russian for "in touch," a Facebook imitator that became the country's most popular social networking site. The last couple days have exemplified that uncertainty. On Thursday, news emerged that talks in Turkey between the Russia and Ukraine yielded no positive result. But on Friday, Reuters reported that Russian President Vladimir Putin said there had been some “positive shifts” in talks between the two sides. Again, in contrast to Facebook, Google and Twitter, Telegram's founder Pavel Durov runs his company in relative secrecy from Dubai. Telegram has gained a reputation as the “secure” communications app in the post-Soviet states, but whenever you make choices about your digital security, it’s important to start by asking yourself, “What exactly am I securing? And who am I securing it from?” These questions should inform your decisions about whether you are using the right tool or platform for your digital security needs. Telegram is certainly not the most secure messaging app on the market right now. Its security model requires users to place a great deal of trust in Telegram’s ability to protect user data. For some users, this may be good enough for now. For others, it may be wiser to move to a different platform for certain kinds of high-risk communications. Markets continued to grapple with the economic and corporate earnings implications relating to the Russia-Ukraine conflict. “We have a ton of uncertainty right now,” said Stephanie Link, chief investment strategist and portfolio manager at Hightower Advisors. “We’re dealing with a war, we’re dealing with inflation. We don’t know what it means to earnings.”
from us


Telegram AIGC
FROM American