-
Notifications
You must be signed in to change notification settings - Fork 3.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bump postgresql driver to 42.3.3 #11449
Conversation
It addresses CVE-2022-21724. It also includes some fixes around calendars being used in thread-safe way, result of PgObject#isNull, possible connection leak and loss of microseconds when reading TIME(6) via getTimestamp.
Does this affect the connector?
Does this affect the connector?
it doesn't affect the connector, right? |
The connection leak does affect us, I was able to reproduce it by setting low per-user connection limit in PostgreSQL. I saw open sockets even if connection attempt failed. The connection does get cleaned up eventually but under load it seems very much possible to have idle sockets. The calendar thread-safety issue is possible to hit by sharing connections across threads - I couldn't find existing code that does this though. The loss of microseconds doesn't affect us since we don't use (All of this context could've gone to the commit message 😞 ) |
the connector doesn't do that (and shouldn't)
Let's have this in RNs. |
Cherry-pick of trinodb/trino#11449 It addresses CVE-2022-21724. Presto uses version 42.2.5 which is in the affected versions (>= 9.4.1208, < 42.2.25). It also includes some fixes around calendars being used in thread-safe way, result of PgObject#isNull, possible connection leak and loss of microseconds when reading TIME(6) via getTimestamp. Co-authored-by: Ashhar Hasan <[email protected]>
Cherry-pick of trinodb/trino#11449 It addresses CVE-2022-21724. Presto uses version 42.2.5 which is in the affected versions (>= 9.4.1208, < 42.2.25). It also includes some fixes around calendars being used in thread-safe way, result of PgObject#isNull, possible connection leak and loss of microseconds when reading TIME(6) via getTimestamp. Co-authored-by: Ashhar Hasan <[email protected]>
Description
It addresses CVE-2022-21724.
It also includes some fixes around calendars being used in thread-safe
way, result of PgObject#isNull, possible connection leak and loss of
microseconds when reading TIME(6) via getTimestamp.
Documentation
(x) No documentation is needed.
Release notes
(x) Release notes entries required with the following suggested text: