SECURITY: Security fix in PostgreSQL 8.1.4

--===============6786419475506548364==
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-yOMrrI+C+gvuCp1Z/y/t"


--=-yOMrrI+C+gvuCp1Z/y/t
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi *,

as anybody should already know the PostgreSQL people released a fix for
possible SQL-injection attacks using multi byte encodings and \'
quoting. psycopg 2 does not use \' quoting when doing its own quoting
(deprecated!) but still calls the weak PQescapeString. Being informed of
the problem some weeks ago by the PostgreSQL team I already had a fix
that I just committed to SVN HEAD, ready for testing.

The fixed code uses the new PQescapeStringConn function, that needs a
reference to the current connection (PGconn). This is not a problem if
you let psycopg adaptation machinery do all the work for you because
psycopg internally calls .prepare() on every string passing it the
current connection. *It is* a problem if you hooked somewhere in the
adaptation code and forgot to call prepare() yourself before calling
getquoted(). So, check your code and take a good look at SQL_IN in
psycopg2.extras if you need an example of how to use prepare() in your
code.

Please, if you're familiar with SVN, check out SVN HEAD and try the new
psycopg. I am doing some tests myself and I plan to release ASAP but
testing from more people is always good.

federico

--=20
Federico Di Gregorio                         http://people.initd.org/fog
Debian GNU/Linux Developer                                [email protected]
INIT.D Developer                                           fog-NGVKUo/i/[email protected]
  All'inizio ho scritto un programma proprietario, in esclusiva per il
   cliente; =C3=A8 stato tristissimo, perch=C3=A9 mi ha succhiato un pezzo =
di
   anima.                                           -- Alessandro Rubini

--=-yOMrrI+C+gvuCp1Z/y/t
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: Questa =?ISO-8859-1?Q?=E8?= una parte del messaggio
	firmata digitalmente

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQBEdKmkvcCgrgZGjesRAsqdAKCsoE1X/1ZVwK/Eyfr2cwTUXa0KWgCeM0U6
jSYC2Kkf4LgE9D6nun588ds=
=ntRb
-----END PGP SIGNATURE-----

--=-yOMrrI+C+gvuCp1Z/y/t--


--===============6786419475506548364==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Psycopg mailing list
Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/psycopg

--===============6786419475506548364==--