Re: [Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] CVE-2018-1057: postgresql-10, postgresql-9.6, postgresql-9.4, postgresql-9.1

[Christoph Berg <myon@debian.org>]

Re: Brian May 2018-03-07 <[🔎] 87a7vk9yhn.fsf@prune.linuxpenguins.xyz>
> > jessie's postgresql-9.1 package is shipping a single binary package
> > only, postgresql-plperl-9.1. (Check the jessie release notes for the
> > rationale.) plperl is not affected by the changes as far as I can tell
> > by inspecting src/pl/plperl's git log.
> 
> Ok, I understand now. So this doesn't apply to wheezy, only Jessie.

We've done that keep-plperl-around-for-upgrades dance a few times in
the past, but dropped it for stretch, as the extra effort didn't seem
worth it, given upgrading works even if oldpg-plperl.deb is
uninstalled.

> > I don't plan to work on a 9.1 LTS release; the changed were deemed
> > below the radar by the Debian Security team, and wheezy's EOL is just
> > around the corner.
> 
> Yes, as the other versions were marked no-dsa, might be best just to
> mark it as no-dsa for wheezy too.
> 
> Any objections if do this?

Please go ahead.

Thanks,
Christoph