[gingerlime]

as far as I understand from the FAQ page, as long as connections to your PG database are blocked from external sources, you should be safe. Seems like a good idea to upgrade as soon as possible anyway though.

  > How can users protect themselves?
  > * Download the update release and update all of your servers as soon as possible.
  > * Ensure that PostgreSQL is not open to connections from untrusted networks.
  > * Audit your database users to be certain that all logins require proper credentials, and that the only logins which exist are legitimate and in current use.

EDIT: added a quote from the FAQ for clarity.

[buttscicles]

It doesn't specify whether pg_hba.conf is sufficient to protect against this, anybody have any word on that?

[selenamarie]

No, pg_hba.conf is not sufficient. I'll work on adding that to the FAQ.

[symfoniq]

I'm wondering this as well.