PostgreSQL relation replacement during pg_dump executes arbitrary SQL

[Zweistein]

Can a Veeam Instalation be afectet by the "PostgreSQL relation replacement during pg_dump executes arbitrary SQL" Problem?
See: https://www.postgresql.org/support/secu ... 2024-7348/

[david.domask]

Hi Zweistein,

I'm checking internally on this; I suspect the answer is "no, no concerns" as it's specifically about pg_dump having a race condition that can be exploited, but will get a confirmation.

However, that being said it looks like it's fixed in PGSQL 15.8, which is supported (15.x is supported). So should be no harm is simply upgrading the Postgres instance to 15.8 where the issue is resolved.

[karsten123]

will the postgresql 15.8 setup be part of the v12.2 update?

[david.domask]

Hi Karsten,

Yes it's planned to include updated Postgres installers on new release ISO(s), but it will still be a manual update process for now. There are plans for auto-updating Postgres, but nothing further to share at this time.

[karsten123]

Hi David,

thank you for the confirmation.
I thought, Anton had already announced that the VBR ISO is also going to update the postgresql.
sad.

[david.domask]

Hi Karsten, you're quite welcome.

And yes, the post I linked is to Anton's public confirmation Just right now nothing further to share on the subject at this moment.

[karsten123]

Anton literally said, that Veeam is taking care of the update. Im confused.

[david.domask]

Yes, as noted it's planned. Will continue in DM, but Anton's post remains correct, it is planned indeed for Veeam to take care of the updates.