Bug 529325 - (CVE-2009-2943) CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
Status: CLOSED RAWHIDE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://www.debian.org/security/2009/d...
impact=moderate,public=20091015,repor...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-10-16 04:41 EDT by Jan Lieskovsky
Modified: 2009-11-10 12:58 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-10-16 06:35:34 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Local copy of relevant bits from ocaml-postgresql-CVE-2009-2943-lenny.patch (4.05 KB, patch)
2009-10-16 04:49 EDT, Jan Lieskovsky
no flags Details | Diff

  None (edit)
Description Jan Lieskovsky 2009-10-16 04:41:53 EDT
Quoting Debian Security Advisory (DSA-1909-1) for postgresql-ocaml:
-------------------------------------------------------------------

It was discovered that postgresql-ocaml, OCaml bindings to PostgreSQL's libpq, was missing a function to call PQescapeStringConn(). This is needed, because PQescapeStringConn() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The added function is called escape_string_conn() and takes the established database connection as a first argument. The old escape_string() was kept for backwards compatibility.

References:
-----------
http://www.debian.org/security/2009/dsa-1909

Debian patch for Lenny:
-----------------------
http://security.debian.org/pool/updates/main/p/postgresql-ocaml/postgresql-ocaml_1.7.0-3+lenny1.diff.gz
Comment 1 Jan Lieskovsky 2009-10-16 04:42:48 EDT
This issue affects the versions of ocaml-postgresql package, as shipped
with Fedora releases of 10 and 11.

Please fix.
Comment 2 Jan Lieskovsky 2009-10-16 04:49:09 EDT
Created attachment 365028 [details]
Local copy of relevant bits from ocaml-postgresql-CVE-2009-2943-lenny.patch
Comment 3 Richard W.M. Jones 2009-10-16 06:09:50 EDT
Upstream have released a new version containing this
fix (verified by inspecting the code and reading the
upstream ChangeLog).  So I'm going to upgrade all
our branches to this new upstream version.
Comment 4 Richard W.M. Jones 2009-10-16 06:35:34 EDT
Built for dist-f13, F12, F11 and F10.

Again I cannot attach the Bodhi updates to this
bug for some reason.  It says
  "Fault 411: 'Password Expired'"
although my password hasn't expired.
Comment 5 Jan Lieskovsky 2009-10-16 06:39:30 EDT
Changed my password today (not sure, if this might be related).
Anyway, approved the updates.
Comment 6 Tomas Hoger 2009-10-16 06:48:33 EDT
(In reply to comment #4)
> Again I cannot attach the Bodhi updates to this
> bug for some reason.  It says
>   "Fault 411: 'Password Expired'"
> although my password hasn't expired.  

How / where did you get that?  Bodhi BZ user password may be expired.
Comment 7 Richard W.M. Jones 2009-10-16 06:56:29 EDT
(In reply to comment #6)
> (In reply to comment #4)
> > Again I cannot attach the Bodhi updates to this
> > bug for some reason.  It says
> >   "Fault 411: 'Password Expired'"
> > although my password hasn't expired.  
> 
> How / where did you get that?  Bodhi BZ user password may be expired.  

See: https://bugzilla.redhat.com/show_bug.cgi?id=529321#c3
Comment 8 Fedora Update System 2009-11-10 12:56:18 EST
ocaml-postgresql-1.12.3-1.fc11.2 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2009-11-10 12:58:12 EST
ocaml-postgresql-1.12.3-1.fc10.2 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.