Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 13 Apr 2012 13:11:52 +0100
From:      Matthew Seaman <>
To:        FreeBSD <>
Cc:        Carmel <>
Subject:   Re: How to handle postgresql82-client vulnerability
Message-ID:  <>
In-Reply-To: <BLU0-SMTP20248E6E6AB7D3975B0B4BC933B0@phx.gbl>
References:  <BLU0-SMTP20248E6E6AB7D3975B0B4BC933B0@phx.gbl>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 13/04/2012 12:23, Carmel wrote:
> I am working on an older machine that has "postgresql-client-8.2.23"
> installed. I have the following information regarding the program:
> $ pkg_info -R postgresql-client-8.2.23
> Information for postgresql-client-8.2.23:
> Required by:
> koffice-kde4-2.3.3_7
> postgresql-libpqxx-3.0.2
> Attempting to build the program produces this error:
> =3D=3D=3D>  postgresql-client-8.2.23 is forbidden: Vulnerable http://ww=
> *** Error code 1
> Stop in /usr/ports/databases/postgresql82-client.

postgresql-8.2 is out of support upstream.  It's only still in the ports
because no one has realised it's past its expiry date and removed it yet.=

Given the unfixed security problems, you should upgrade to a newer
version ASAP.

> I cannot find anything in the UPDATING or MOVED files that details how
> to deal with this. Would something like:
> 	portupgrade -o databases/postgresql90-client postgresql82-client
> be the proper way to handle this problem? Would I then have to rebuild
> koffice-kde4-2.3.3_7 and postgresql-libpqxx-3.0.2 to insure that everyt=
hing works correctly?

Correct, as far as dealing with the ports goes.  Yes, you will have to
recompile anything that links against, which is probably more
than shows up in the output of 'pkg_info -R' -- you can use the lib_chk
script from bsdadminscripts to find everything that needs to be rebuilt.
 Or just 'portmaster -r databases/postgresql90-client'

However, there is no guarantee that you can just start up postgresql90
and expect it to work with the postgresql82 data directory. (Although
why not postgresql91 rather than 90? There's no good reason not to use
the latest release.)

As the ports don't support installing several versions of postgresql
simultaneously, or encode the postgres version into the PGDATA path
(which is a fairly standard approach on various other unixoid
environments) you won't be able to use pg_upgrade easily.

Given that in-place updates are not feasible, you should dump the
contents of your database cluster and then reload it into a newly
created cluster using the latest version.  The PG documentation
recommends using the client from the version you are updating to for
creating the dumps, or else they may not reload cleanly.  In fact, there
are changes between 8.x and 9.0 to do with the encoding of non-ascii
character data which are quite likely to cause difficulties for you.
Note that you can install an updated client on a different box and dump
remotely as a relatively simple way of using a new client to access an
older DB.

Ideally you should create a brand new DB cluster on a separate system,
so you can have as many goes at pulling the data over from your original
database as you need to get it right without destroying the originals.
If you lack the resources to do that, then better make sure you've got
good backups.



Dr Matthew J Seaman MA, D.Phil.

Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

Version: GnuPG/MacGPG2 v2.0.16 (Darwin)
Comment: Using GnuPG with Mozilla -



Want to link to this message? Use this URL: <>