<- Back
Comments (13)
- ianberdinLooking at all these security patches reminded me of when I was a kid and I thoroughly cleaned my apartment, wiped away every bit of dust in every single crevice, and then a couple of days later it was all back again. And I thought: am I really going to be doing this my whole life?
- firerAll of these seem to be post-auth, except for CVE-2026-116322 (which doesn't grant code execution, "only" a DoS).About a year ago I found and exploited CVE-2026-2004, which is also a Postgres post-auth RCE, as part of Wiz's zeroday.cloud competition.I choose that target because it immediately stood out as highly complex with lots of user input. In my opinion, it's a bad idea to define this as a security boundary in the first place. Access to a database can very likely lead to code execution - there's way too much attack surface.Most serious cloud providers rightly sandbox their DB offerings exactly for this reason. And this year's zeroday.cloud competition no longer has authenticated Postgres as a target, exactly for this reason.
- lfittlFWIW, I found it easier to look at the release notes (https://www.postgresql.org/docs/release/18.7/) to understand the overall scope of the CVEs - from the announcement the individual CVE pages are linked, but its hard to scan.
- zuluxMega patches like this, in my opinion, should be treated as mandatory patches. If I were trying to get a significant security update into the field in the age of LLM drama, this is how I would do it.
- conradfrWhat is the usual delay for the official Docker image update?
- simonw"This release fixes 52 security vulnerabilities and over 140 bugs reported over the last several months."
- sick_of_slop[dead]