Post B6IxnTEuWMBEDk3zeq by hailey@hails.org
 (DIR) More posts by hailey@hails.org
 (DIR) Post #B6IxiSl4sm7VHRin7Q by hailey@hails.org
       0 likes, 0 repeats
       
       I read that Postgres *itself* had an SQL injection vuln so I was like HUH and tracked down the fix... what are we doing here guys
       
 (DIR) Post #B6IxiSxU8e2ptvWhSS by hailey@hails.org
       0 likes, 0 repeats
       
       In the same batch of fixes there is an RCE where Postgres passes user input straight into the sprintf format string omg
       
 (DIR) Post #B6IxiT5zd0qmKJVUie by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @hailey wait what
       
 (DIR) Post #B6Ixjf1GmV2db5rldA by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @hailey was it at least snprintf
       
 (DIR) Post #B6IxnTEuWMBEDk3zeq by hailey@hails.org
       0 likes, 0 repeats
       
       @azonenberg it was snprintf. fix here https://github.com/postgres/postgres/commit/ba27389c2cfa1485bbe26754b23d3f6b4c4e72e2, full list of fixed cves here https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/