Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump PostgreSQL driver from 42.3.3 -> 42.4.1 to remediate CVE-2022-31197 #6205

Merged
merged 2 commits into from Aug 31, 2022
Merged

Bump PostgreSQL driver from 42.3.3 -> 42.4.1 to remediate CVE-2022-31197 #6205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
66ac9af
bump postgres version to get out of CVE
mdaudali Aug 30, 2022
c009169
Add generated changelog entries
svc-changelog Aug 31, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 5 additions & 0 deletions changelog/@unreleased/pr-6205.v2.yml
View file
Open in desktop
@@ -0,0 +1,5 @@
type: improvement
improvement:
description: Bump PostgreSQL driver from 42.3.3 -> 42.4.1 to remediate CVE
links:
- https://github.com/palantir/atlasdb/pull/6205
2 changes: 1 addition & 1 deletion versions.lock
View file
Open in desktop
Expand Up @@ -304,7 +304,7 @@ org.ow2.asm:asm-analysis:5.0.3 (1 constraints: ee09d4b2)
org.ow2.asm:asm-commons:5.0.3 (1 constraints: ee09d4b2)
org.ow2.asm:asm-tree:5.0.3 (4 constraints: d8272223)
org.ow2.asm:asm-util:5.0.3 (1 constraints: ee09d4b2)
org.postgresql:postgresql:42.3.3 (1 constraints: 3e054f3b)
org.postgresql:postgresql:42.4.1 (1 constraints: 3d05503b)
org.reflections:reflections:0.10.2 (1 constraints: 3505253b)
org.rocksdb:rocksdbjni:7.4.4 (1 constraints: 11051e36)
org.slf4j:jcl-over-slf4j:1.7.36 (3 constraints: 432fe5ed)
Expand Down
2 changes: 1 addition & 1 deletion versions.props
View file
Open in desktop
Expand Up @@ -88,7 +88,7 @@ uk.org.lidalia:slf4j-test = 1.1.0
com.datastax.cassandra:cassandra-driver-core = 3.8.0
com.oracle.database.jdbc:ojdbc11 = 21.5.0.0
com.palantir.cassandra:* = 2.2.13-1.6.0
org.postgresql:postgresql = 42.3.3
org.postgresql:postgresql = 42.4.1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we bump to 42.4.2 or 42.5.0? see #6206

From https://jdbc.postgresql.org/documentation/changelog.html#version_42.5.0

Version 42.5.0 (2022-08-24)

Notable changes

Changed

Version 42.4.2 (2022-08-17)

Notable changes

Changed

Added

  • fix: make setObject accept UUID array PR #2587

Fixed

  • fix: regression with GSS. Changes introduced to support building with Java 17 caused failures Issue #2588
  • fix: set a timeout to get the return from requesting SSL upgrade. PR #2572
  • feat: synchronize statement executions (e.g. avoid deadlock when Connection.isValid is executed from concurrent threads)

Version 42.4.1 (2022-08-03)

Notable changes

Security

  • fix: CVE-2022-31197 Fixes SQL generated in PgResultSet.refresh() to escape column identifiers so as to prevent SQL injection.
    Previously, the column names for both key and data columns in the table were copied as-is into the generated SQL. This allowed a malicious table with column names that include statement terminator to be parsed and executed as multiple separate commands.
    Also adds a new test class ResultSetRefreshTest to verify this change.
    Reported by Sho Kato

Changed

  • chore: skip publishing pgjdbc-osgi-test to Central
  • chore: bump Gradle to 7.5
  • test: update JUnit to 5.8.2

Added

  • chore: added Gradle Wrapper Validation for verifying gradle-wrapper.jar
  • chore: added "permissions: contents: read" for GitHub Actions to avoid unintentional modifications by the CI
  • chore: support building pgjdbc with Java 17

Version 42.4.0 (2022-06-09)

Notable changes

Changed

Fixed

Version 42.3.6 (2022-05-24)

Notable changes

Fixed

  • fix: close refcursors when underlying cursor==null instead of relying on defaultRowFetchSize PR sweep faster #2377

Version 42.3.5 (2022-05-04)

Notable changes

Known issues

  • Regression since 42.3.2: "cursor does not exist" when using ResultSet.setFetchSize from CallableStatement, fixed in 42.3.6 (see PG sweep faster #2377)

Changed

  • test: polish TimestampUtilsTest
  • chore: use GitHub Action concurrency feature to terminate CI jobs on fast PR pushes

Added

  • Added KEYS file to allow for verifying artifacts PR 2499

Fixed

  • perf: enable tcpNoDelay by default PR 2495. This is a regression from 42.2.x versions where tcpNoDelay defaulted to true
  • docs: fix readme.md after PR 2495 PR 2496
  • feat: targetServerType=preferPrimary connection parameter PR 2483
  • fix: revert removal of toOffsetDateTime(String timestamp) fixes Issue DbKvs sweep refactors to address last PR comments #2497 PR 2501

Version 42.3.4 (2022-04-15)

Notable changes

Known issues

  • Regression since 42.3.2: "cursor does not exist" when using ResultSet.setFetchSize from CallableStatement, fixed in 42.3.6 (see PG sweep faster #2377)

Changed

Fixed

  • docs: Update testing documentation PR 2446
  • fix: Throw an exception if the driver cannot parse the URL instead of returning NULL fixes Issue More hints for getRange() on Oracle #2421 PR 2441
  • fix: Use PGProperty instead of the property names directly PR 2444
  • docs: update changelog, missing links at bottom and formatting PR 2460
  • fix: Remove isDeprecated from PGProperty. It was originally intended to help produce automated docs. Fixes #Issue 2479 PR 2480
  • fix: change PGInterval parseISO8601Format to support fractional second PR 2457
  • fix: More test and fix for issues discovered by PR Feature/serialisable tm initialise check #2476 PR 0.60 release notes #2488

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For safety, I went with the version that has the fix and that our large internal postgres user uses. We can definitely evaluate going higher (and evaluating the risks), but I think we should stick to the lower version that's been tested. cc @jeremyk-91 in case you have other thoughts!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's get this out first, we can do the .5.0 one in a bit once things are stabler? We've had historic badness with this driver in the past unfortunately


# transitive dep with API breaks in 0.14.0
org.apache.thrift:libthrift = 0.12.0
Expand Down