Re: SECURITY: Security fix in PostgreSQL 8.1.4

On 5/24/06, Federico Di Gregorio <fog-NGVKUo/i/[email protected]> wrote:
> Hi *,
>
> as anybody should already know the PostgreSQL people released a fix for
> possible SQL-injection attacks using multi byte encodings and \'
> quoting. psycopg 2 does not use \' quoting when doing its own quoting
> (deprecated!) but still calls the weak PQescapeString. Being informed of
> the problem some weeks ago by the PostgreSQL team I already had a fix
> that I just committed to SVN HEAD, ready for testing.
>
> The fixed code uses the new PQescapeStringConn function, that needs a
> reference to the current connection (PGconn). This is not a problem if
> you let psycopg adaptation machinery do all the work for you because
> psycopg internally calls .prepare() on every string passing it the
> current connection. *It is* a problem if you hooked somewhere in the
> adaptation code and forgot to call prepare() yourself before calling
> getquoted(). So, check your code and take a good look at SQL_IN in
> psycopg2.extras if you need an example of how to use prepare() in your
> code.
>
> Please, if you're familiar with SVN, check out SVN HEAD and try the new
> psycopg. I am doing some tests myself and I plan to release ASAP but
> testing from more people is always good.
>
> federico
>
> --
> Federico Di Gregorio                         http://people.initd.org/fog
> Debian GNU/Linux Developer                                [email protected]
> INIT.D Developer                                           fog-NGVKUo/i/[email protected]
>   All'inizio ho scritto un programma proprietario, in esclusiva per il
>    cliente; =E8 stato tristissimo, perch=E9 mi ha succhiato un pezzo di
>    anima.                                           -- Alessandro Rubini
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (GNU/Linux)
>
> iD8DBQBEdKmkvcCgrgZGjesRAsqdAKCsoE1X/1ZVwK/Eyfr2cwTUXa0KWgCeM0U6
> jSYC2Kkf4LgE9D6nun588ds=3D
> =3DntRb
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> Psycopg mailing list
> Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
> http://lists.initd.org/mailman/listinfo/psycopg
>
>
>



how stable is the  psycopg2 for critical produccion   ???

thanks