Bug 529325 (CVE-2009-2943) - CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
Summary: CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
Keywords:
Status: CLOSED RAWHIDE
Alias: CVE-2009-2943
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://www.debian.org/security/2009/d...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-10-16 08:41 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:32 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-10-16 10:35:34 UTC


Attachments (Terms of Use)
Local copy of relevant bits from ocaml-postgresql-CVE-2009-2943-lenny.patch (4.05 KB, patch)
2009-10-16 08:49 UTC, Jan Lieskovsky
no flags Details | Diff

Description Jan Lieskovsky 2009-10-16 08:41:53 UTC
Quoting Debian Security Advisory (DSA-1909-1) for postgresql-ocaml:
-------------------------------------------------------------------

It was discovered that postgresql-ocaml, OCaml bindings to PostgreSQL's libpq, was missing a function to call PQescapeStringConn(). This is needed, because PQescapeStringConn() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The added function is called escape_string_conn() and takes the established database connection as a first argument. The old escape_string() was kept for backwards compatibility.

References:
-----------
http://www.debian.org/security/2009/dsa-1909

Debian patch for Lenny:
-----------------------
http://security.debian.org/pool/updates/main/p/postgresql-ocaml/postgresql-ocaml_1.7.0-3+lenny1.diff.gz

Comment 1 Jan Lieskovsky 2009-10-16 08:42:48 UTC
This issue affects the versions of ocaml-postgresql package, as shipped
with Fedora releases of 10 and 11.

Please fix.

Comment 2 Jan Lieskovsky 2009-10-16 08:49:09 UTC
Created attachment 365028 [details]
Local copy of relevant bits from ocaml-postgresql-CVE-2009-2943-lenny.patch

Comment 3 Richard W.M. Jones 2009-10-16 10:09:50 UTC
Upstream have released a new version containing this
fix (verified by inspecting the code and reading the
upstream ChangeLog).  So I'm going to upgrade all
our branches to this new upstream version.

Comment 4 Richard W.M. Jones 2009-10-16 10:35:34 UTC
Built for dist-f13, F12, F11 and F10.

Again I cannot attach the Bodhi updates to this
bug for some reason.  It says
  "Fault 411: 'Password Expired'"
although my password hasn't expired.

Comment 5 Jan Lieskovsky 2009-10-16 10:39:30 UTC
Changed my password today (not sure, if this might be related).
Anyway, approved the updates.

Comment 6 Tomas Hoger 2009-10-16 10:48:33 UTC
(In reply to comment #4)
> Again I cannot attach the Bodhi updates to this
> bug for some reason.  It says
>   "Fault 411: 'Password Expired'"
> although my password hasn't expired.  

How / where did you get that?  Bodhi BZ user password may be expired.

Comment 7 Richard W.M. Jones 2009-10-16 10:56:29 UTC
(In reply to comment #6)
> (In reply to comment #4)
> > Again I cannot attach the Bodhi updates to this
> > bug for some reason.  It says
> >   "Fault 411: 'Password Expired'"
> > although my password hasn't expired.  
> 
> How / where did you get that?  Bodhi BZ user password may be expired.  

See: https://bugzilla.redhat.com/show_bug.cgi?id=529321#c3

Comment 8 Fedora Update System 2009-11-10 17:56:18 UTC
ocaml-postgresql-1.12.3-1.fc11.2 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2009-11-10 17:58:12 UTC
ocaml-postgresql-1.12.3-1.fc10.2 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.