Skip to content

Commit 50abeaf

Browse files
tglsfdctglsfdc
committed
Last-minute updates for release notes.
Security: CVE-2017-12172, CVE-2017-15098, CVE-2017-15099
1 parent c30f082 commit 50abeaf

File tree

6 files changed

+364
-3
lines changed

6 files changed

+364
-3
lines changed

‎doc/src/sgml/release-10.sgml

Lines changed: 107 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
</para>
2424

2525
<para>
26-
However, if you use BRIN indexes, see the first changelog entry below.
26+
However, if you use BRIN indexes, see the fourth changelog entry below.
2727
</para>
2828
</sect2>
2929

@@ -34,6 +34,92 @@
3434

3535
<listitem>
3636
<!--
37+
Author: Dean Rasheed <dean.a.rasheed@gmail.com>
38+
Branch: master [87b2ebd35] 2017-11-06 09:19:22 +0000
39+
Branch: REL_10_STABLE [3f8089572] 2017-11-06 09:17:44 +0000
40+
Branch: REL9_6_STABLE [1f23d1cd2] 2017-11-06 09:16:24 +0000
41+
Branch: REL9_5_STABLE [045a18888] 2017-11-06 09:15:11 +0000
42+
-->
43+
<para>
44+
Ensure that <literal>INSERT ... ON CONFLICT DO UPDATE</literal> checks
45+
table permissions and RLS policies in all cases (Dean Rasheed)
46+
</para>
47+
48+
<para>
49+
The update path of <literal>INSERT ... ON CONFLICT DO UPDATE</literal>
50+
requires <literal>SELECT</literal> permission on the columns of the
51+
arbiter index, but it failed to check for that in the case of an
52+
arbiter specified by constraint name.
53+
In addition, for a table with row level security enabled, it failed to
54+
check updated rows against the table's <literal>SELECT</literal>
55+
policies (regardless of how the arbiter index was specified).
56+
(CVE-2017-15099)
57+
</para>
58+
</listitem>
59+
60+
<listitem>
61+
<!--
62+
Author: Tom Lane <tgl@sss.pgh.pa.us>
63+
Branch: master [b57422871] 2017-11-06 10:29:37 -0500
64+
Branch: REL_10_STABLE [c30f082d2] 2017-11-06 10:29:38 -0500
65+
Branch: REL9_6_STABLE [38e825632] 2017-11-06 10:29:39 -0500
66+
Branch: REL9_5_STABLE [d5fe5fb23] 2017-11-06 10:29:40 -0500
67+
Branch: REL9_4_STABLE [70846ee05] 2017-11-06 10:29:41 -0500
68+
Branch: REL9_3_STABLE [c0c8807de] 2017-11-06 10:29:42 -0500
69+
-->
70+
<para>
71+
Fix crash due to rowtype mismatch
72+
in <function>json{b}_populate_recordset()</function>
73+
(Michael Paquier, Tom Lane)
74+
</para>
75+
76+
<para>
77+
These functions used the result rowtype specified in the <literal>FROM
78+
... AS</literal> clause without checking that it matched the actual
79+
rowtype of the supplied tuple value. If it didn't, that would usually
80+
result in a crash, though disclosure of server memory contents seems
81+
possible as well.
82+
(CVE-2017-15098)
83+
</para>
84+
</listitem>
85+
86+
<listitem>
87+
<!--
88+
Author: Noah Misch <noah@leadboat.com>
89+
Branch: master [dfc015dcf] 2017-11-06 07:11:10 -0800
90+
Branch: REL_10_STABLE [6b0b983f7] 2017-11-06 07:11:13 -0800
91+
Branch: REL9_6_STABLE [b7d6f7507] 2017-11-06 07:11:13 -0800
92+
Branch: REL9_5_STABLE [ed546dd06] 2017-11-06 07:11:13 -0800
93+
Branch: REL9_4_STABLE [29d067051] 2017-11-06 07:11:13 -0800
94+
Branch: REL9_3_STABLE [b50029768] 2017-11-06 07:11:13 -0800
95+
Branch: REL9_2_STABLE [eda780281] 2017-11-06 07:11:13 -0800
96+
-->
97+
<para>
98+
Fix sample server-start scripts to become <literal>$PGUSER</literal>
99+
before opening <literal>$PGLOG</literal> (Noah Misch)
100+
</para>
101+
102+
<para>
103+
Previously, the postmaster log file was opened while still running as
104+
root. The database owner could therefore mount an attack against
105+
another system user by making <literal>$PGLOG</literal> be a symbolic
106+
link to some other file, which would then become corrupted by appending
107+
log messages.
108+
</para>
109+
110+
<para>
111+
By default, these scripts are not installed anywhere. Users who have
112+
made use of them will need to manually recopy them, or apply the same
113+
changes to their modified versions. If the
114+
existing <literal>$PGLOG</literal> file is root-owned, it will need to
115+
be removed or renamed out of the way before restarting the server with
116+
the corrected script.
117+
(CVE-2017-12172)
118+
</para>
119+
</listitem>
120+
121+
<listitem>
122+
<!--
37123
Author: Alvaro Herrera <alvherre@alvh.no-ip.org>
38124
Branch: master [ec42a1dcb] 2017-11-03 17:23:13 +0100
39125
Branch: REL_10_STABLE [37a856567] 2017-11-03 17:23:13 +0100
@@ -595,6 +681,26 @@ Branch: REL9_3_STABLE [deb429b51] 2017-11-03 12:40:42 +0100
595681

596682
<listitem>
597683
<!--
684+
Author: Noah Misch <noah@leadboat.com>
685+
Branch: master [c66b438db] 2017-11-05 18:51:08 -0800
686+
Branch: REL_10_STABLE [937f67800] 2017-11-05 18:51:15 -0800
687+
Branch: REL9_6_STABLE [971983f42] 2017-11-05 18:52:38 -0800
688+
Branch: REL9_5_STABLE [014c5cd87] 2017-11-05 18:54:52 -0800
689+
-->
690+
<para>
691+
Fix missing temp-install prerequisites
692+
for <literal>check</literal>-like Make targets (Noah Misch)
693+
</para>
694+
695+
<para>
696+
Some non-default test procedures that are meant to work
697+
like <literal>make check</literal> failed to ensure that the temporary
698+
installation was up to date.
699+
</para>
700+
</listitem>
701+
702+
<listitem>
703+
<!--
598704
Author: Tom Lane <tgl@sss.pgh.pa.us>
599705
Branch: master [8df4ce1ea] 2017-10-23 18:15:36 -0400
600706
Branch: REL_10_STABLE [0cde56247] 2017-10-23 18:15:42 -0400

‎doc/src/sgml/release-9.2.sgml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,31 @@
4040

4141
<itemizedlist>
4242

43+
<listitem>
44+
<para>
45+
Fix sample server-start scripts to become <literal>$PGUSER</literal>
46+
before opening <literal>$PGLOG</literal> (Noah Misch)
47+
</para>
48+
49+
<para>
50+
Previously, the postmaster log file was opened while still running as
51+
root. The database owner could therefore mount an attack against
52+
another system user by making <literal>$PGLOG</literal> be a symbolic
53+
link to some other file, which would then become corrupted by appending
54+
log messages.
55+
</para>
56+
57+
<para>
58+
By default, these scripts are not installed anywhere. Users who have
59+
made use of them will need to manually recopy them, or apply the same
60+
changes to their modified versions. If the
61+
existing <literal>$PGLOG</literal> file is root-owned, it will need to
62+
be removed or renamed out of the way before restarting the server with
63+
the corrected script.
64+
(CVE-2017-12172)
65+
</para>
66+
</listitem>
67+
4368
<listitem>
4469
<para>
4570
Properly reject attempts to convert infinite float values to

‎doc/src/sgml/release-9.3.sgml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,48 @@
3434

3535
<itemizedlist>
3636

37+
<listitem>
38+
<para>
39+
Fix crash due to rowtype mismatch
40+
in <function>json{b}_populate_recordset()</function>
41+
(Michael Paquier, Tom Lane)
42+
</para>
43+
44+
<para>
45+
These functions used the result rowtype specified in the <literal>FROM
46+
... AS</literal> clause without checking that it matched the actual
47+
rowtype of the supplied tuple value. If it didn't, that would usually
48+
result in a crash, though disclosure of server memory contents seems
49+
possible as well.
50+
(CVE-2017-15098)
51+
</para>
52+
</listitem>
53+
54+
<listitem>
55+
<para>
56+
Fix sample server-start scripts to become <literal>$PGUSER</literal>
57+
before opening <literal>$PGLOG</literal> (Noah Misch)
58+
</para>
59+
60+
<para>
61+
Previously, the postmaster log file was opened while still running as
62+
root. The database owner could therefore mount an attack against
63+
another system user by making <literal>$PGLOG</literal> be a symbolic
64+
link to some other file, which would then become corrupted by appending
65+
log messages.
66+
</para>
67+
68+
<para>
69+
By default, these scripts are not installed anywhere. Users who have
70+
made use of them will need to manually recopy them, or apply the same
71+
changes to their modified versions. If the
72+
existing <literal>$PGLOG</literal> file is root-owned, it will need to
73+
be removed or renamed out of the way before restarting the server with
74+
the corrected script.
75+
(CVE-2017-12172)
76+
</para>
77+
</listitem>
78+
3779
<listitem>
3880
<para>
3981
Properly reject attempts to convert infinite float values to

‎doc/src/sgml/release-9.4.sgml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,48 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix crash due to rowtype mismatch
39+
in <function>json{b}_populate_recordset()</function>
40+
(Michael Paquier, Tom Lane)
41+
</para>
42+
43+
<para>
44+
These functions used the result rowtype specified in the <literal>FROM
45+
... AS</literal> clause without checking that it matched the actual
46+
rowtype of the supplied tuple value. If it didn't, that would usually
47+
result in a crash, though disclosure of server memory contents seems
48+
possible as well.
49+
(CVE-2017-15098)
50+
</para>
51+
</listitem>
52+
53+
<listitem>
54+
<para>
55+
Fix sample server-start scripts to become <literal>$PGUSER</literal>
56+
before opening <literal>$PGLOG</literal> (Noah Misch)
57+
</para>
58+
59+
<para>
60+
Previously, the postmaster log file was opened while still running as
61+
root. The database owner could therefore mount an attack against
62+
another system user by making <literal>$PGLOG</literal> be a symbolic
63+
link to some other file, which would then become corrupted by appending
64+
log messages.
65+
</para>
66+
67+
<para>
68+
By default, these scripts are not installed anywhere. Users who have
69+
made use of them will need to manually recopy them, or apply the same
70+
changes to their modified versions. If the
71+
existing <literal>$PGLOG</literal> file is root-owned, it will need to
72+
be removed or renamed out of the way before restarting the server with
73+
the corrected script.
74+
(CVE-2017-12172)
75+
</para>
76+
</listitem>
77+
3678
<listitem>
3779
<para>
3880
Fix crash when logical decoding is invoked from a SPI-using function,

‎doc/src/sgml/release-9.5.sgml

Lines changed: 74 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
</para>
2424

2525
<para>
26-
However, if you use BRIN indexes, see the first changelog entry below.
26+
However, if you use BRIN indexes, see the fourth changelog entry below.
2727
</para>
2828

2929
<para>
@@ -37,6 +37,66 @@
3737

3838
<itemizedlist>
3939

40+
<listitem>
41+
<para>
42+
Ensure that <literal>INSERT ... ON CONFLICT DO UPDATE</literal> checks
43+
table permissions and RLS policies in all cases (Dean Rasheed)
44+
</para>
45+
46+
<para>
47+
The update path of <literal>INSERT ... ON CONFLICT DO UPDATE</literal>
48+
requires <literal>SELECT</literal> permission on the columns of the
49+
arbiter index, but it failed to check for that in the case of an
50+
arbiter specified by constraint name.
51+
In addition, for a table with row level security enabled, it failed to
52+
check updated rows against the table's <literal>SELECT</literal>
53+
policies (regardless of how the arbiter index was specified).
54+
(CVE-2017-15099)
55+
</para>
56+
</listitem>
57+
58+
<listitem>
59+
<para>
60+
Fix crash due to rowtype mismatch
61+
in <function>json{b}_populate_recordset()</function>
62+
(Michael Paquier, Tom Lane)
63+
</para>
64+
65+
<para>
66+
These functions used the result rowtype specified in the <literal>FROM
67+
... AS</literal> clause without checking that it matched the actual
68+
rowtype of the supplied tuple value. If it didn't, that would usually
69+
result in a crash, though disclosure of server memory contents seems
70+
possible as well.
71+
(CVE-2017-15098)
72+
</para>
73+
</listitem>
74+
75+
<listitem>
76+
<para>
77+
Fix sample server-start scripts to become <literal>$PGUSER</literal>
78+
before opening <literal>$PGLOG</literal> (Noah Misch)
79+
</para>
80+
81+
<para>
82+
Previously, the postmaster log file was opened while still running as
83+
root. The database owner could therefore mount an attack against
84+
another system user by making <literal>$PGLOG</literal> be a symbolic
85+
link to some other file, which would then become corrupted by appending
86+
log messages.
87+
</para>
88+
89+
<para>
90+
By default, these scripts are not installed anywhere. Users who have
91+
made use of them will need to manually recopy them, or apply the same
92+
changes to their modified versions. If the
93+
existing <literal>$PGLOG</literal> file is root-owned, it will need to
94+
be removed or renamed out of the way before restarting the server with
95+
the corrected script.
96+
(CVE-2017-12172)
97+
</para>
98+
</listitem>
99+
40100
<listitem>
41101
<para>
42102
Fix BRIN index summarization to handle concurrent table extension
@@ -259,6 +319,19 @@
259319
</para>
260320
</listitem>
261321

322+
<listitem>
323+
<para>
324+
Fix missing temp-install prerequisites
325+
for <literal>check</literal>-like Make targets (Noah Misch)
326+
</para>
327+
328+
<para>
329+
Some non-default test procedures that are meant to work
330+
like <literal>make check</literal> failed to ensure that the temporary
331+
installation was up to date.
332+
</para>
333+
</listitem>
334+
262335
<listitem>
263336
<para>
264337
Sync our copy of the timezone library with IANA release tzcode2017c

0 commit comments

Comments
 (0)