Bug 529325 (CVE-2009-2943)

Summary: CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rjones
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.debian.org/security/2009/dsa-1909
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-10-16 10:35:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Local copy of relevant bits from ocaml-postgresql-CVE-2009-2943-lenny.patch none

Description Jan Lieskovsky 2009-10-16 08:41:53 UTC 
Quoting Debian Security Advisory (DSA-1909-1) for postgresql-ocaml:
-------------------------------------------------------------------

It was discovered that postgresql-ocaml, OCaml bindings to PostgreSQL's libpq, was missing a function to call PQescapeStringConn(). This is needed, because PQescapeStringConn() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The added function is called escape_string_conn() and takes the established database connection as a first argument. The old escape_string() was kept for backwards compatibility.

References:
-----------
http://www.debian.org/security/2009/dsa-1909

Debian patch for Lenny:
-----------------------
http://security.debian.org/pool/updates/main/p/postgresql-ocaml/postgresql-ocaml_1.7.0-3+lenny1.diff.gz
Comment 1 Jan Lieskovsky 2009-10-16 08:42:48 UTC 
This issue affects the versions of ocaml-postgresql package, as shipped
with Fedora releases of 10 and 11.

Please fix.
Comment 2 Jan Lieskovsky 2009-10-16 08:49:09 UTC 
Created attachment 365028 [details]
Local copy of relevant bits from ocaml-postgresql-CVE-2009-2943-lenny.patch
Comment 3 Richard W.M. Jones 2009-10-16 10:09:50 UTC 
Upstream have released a new version containing this
fix (verified by inspecting the code and reading the
upstream ChangeLog).  So I'm going to upgrade all
our branches to this new upstream version.
Comment 4 Richard W.M. Jones 2009-10-16 10:35:34 UTC 
Built for dist-f13, F12, F11 and F10.

Again I cannot attach the Bodhi updates to this
bug for some reason.  It says
  "Fault 411: 'Password Expired'"
although my password hasn't expired.
Comment 5 Jan Lieskovsky 2009-10-16 10:39:30 UTC 
Changed my password today (not sure, if this might be related).
Anyway, approved the updates.
Comment 6 Tomas Hoger 2009-10-16 10:48:33 UTC 
(In reply to comment #4)
> Again I cannot attach the Bodhi updates to this
> bug for some reason.  It says
>   "Fault 411: 'Password Expired'"
> although my password hasn't expired.  

How / where did you get that?  Bodhi BZ user password may be expired.
Comment 7 Richard W.M. Jones 2009-10-16 10:56:29 UTC 
(In reply to comment #6)
> (In reply to comment #4)
> > Again I cannot attach the Bodhi updates to this
> > bug for some reason.  It says
> >   "Fault 411: 'Password Expired'"
> > although my password hasn't expired.  
> 
> How / where did you get that?  Bodhi BZ user password may be expired.  

See: https://bugzilla.redhat.com/show_bug.cgi?id=529321#c3
Comment 8 Fedora Update System 2009-11-10 17:56:18 UTC 
ocaml-postgresql-1.12.3-1.fc11.2 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2009-11-10 17:58:12 UTC 
ocaml-postgresql-1.12.3-1.fc10.2 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.