Horton

Re: PostgreSQL - Weak DH group

Alvaro Herrera <alvherre@2ndquadrant.com>

View thread View on postgr.es
From: Alvaro Herrera <alvherre@2ndquadrant.com>
To: Michael Paquier <michael.paquier@gmail.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>, Christoph Berg <myon@debian.org>, Nicolas Guini <nicolasguini@gmail.com>, PostgreSQL mailing lists <pgsql-hackers@postgresql.org>, Damian Quiroga <qdamian@gmail.com>
Date: 2017-07-13T17:04:02Z
Lists: pgsql-hackers 
Michael Paquier wrote:
> On Thu, Jul 13, 2017 at 5:32 PM, Heikki Linnakangas <hlinnaka@iki.fi> wrote:

> > Objections to committing this now, instead of waiting for v11?
> 
> But I am -1 for the sneak part. It is not the time to have a new
> feature in 10, the focus is to stabilize.

But if we were treating it as a security issue, would we backpatch it?
If we do, then it definitely makes sense to put something in pg10.  I'm
not sure that this patch is it, though -- perhaps it makes sense to put
a minimal fix in older branches, and let the new feature wait for pg11?

-- 
Álvaro Herrera                https://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

Commits

  1. Always use 2048 bit DH parameters for OpenSSL ephemeral DH ciphers.