Most databases run offline and don't allow arbitrary SQL statements. SQL injections are generally eliminated by using the extended protocol.
replySo, yes, if you're running multi-tenant Postgres as a public service, you should upgrade. Everyone else is in no rush.
No rush, but don't wait too long either.
replyYes, the application above it should prevent SQL injection, but if it's imperfect, you don't want an attacker to turn SQL injection into RCE.
then, what would you do if you were an adversary trying to push your xz-style vulnerability to every place known to man?
replySo you're in favor of applying security patches? Controversial opinion.
reply