Skip to content

Commit e0ee930

Browse files
tglsfdctglsfdc
committed
Last-minute updates for release notes.
Security: CVE-2018-10915, CVE-2018-10925
1 parent d1c6a14 commit e0ee930

File tree

5 files changed

+221
-53
lines changed

5 files changed

+221
-53
lines changed

‎doc/src/sgml/release-10.sgml

Lines changed: 67 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,73 @@
3535

3636
<listitem>
3737
<!--
38+
Author: Tom Lane <tgl@sss.pgh.pa.us>
39+
Branch: master [d1c6a14ba] 2018-08-06 10:53:35 -0400
40+
Branch: REL_11_STABLE [f6f735f78] 2018-08-06 10:53:35 -0400
41+
Branch: REL_10_STABLE [ab5400469] 2018-08-06 10:53:35 -0400
42+
Branch: REL9_6_STABLE [a8094d0fe] 2018-08-06 10:53:35 -0400
43+
Branch: REL9_5_STABLE [7aabfd1d8] 2018-08-06 10:53:35 -0400
44+
Branch: REL9_4_STABLE [6de9766b8] 2018-08-06 10:53:35 -0400
45+
Branch: REL9_3_STABLE [243de06be] 2018-08-06 10:53:35 -0400
46+
-->
47+
<para>
48+
Fix failure to reset <application>libpq</application>'s state fully
49+
between connection attempts (Tom Lane)
50+
</para>
51+
52+
<para>
53+
An unprivileged user of <filename>dblink</filename>
54+
or <filename>postgres_fdw</filename> could bypass the checks intended
55+
to prevent use of server-side credentials, such as
56+
a <filename>~/.pgpass</filename> file owned by the operating-system
57+
user running the server. Servers allowing peer authentication on
58+
local connections are particularly vulnerable. Other attacks such
59+
as SQL injection into a <filename>postgres_fdw</filename> session
60+
are also possible.
61+
Attacking <filename>postgres_fdw</filename> in this way requires the
62+
ability to create a foreign server object with selected connection
63+
parameters, but any user with access to <filename>dblink</filename>
64+
could exploit the problem.
65+
In general, an attacker with the ability to select the connection
66+
parameters for a <application>libpq</application>-using application
67+
could cause mischief, though other plausible attack scenarios are
68+
harder to think of.
69+
Our thanks to Andrew Krasichkov for reporting this issue.
70+
(CVE-2018-10915)
71+
</para>
72+
</listitem>
73+
74+
<listitem>
75+
<!--
76+
Author: Tom Lane <tgl@sss.pgh.pa.us>
77+
Branch: master [b8a1247a3] 2018-08-04 19:38:58 -0400
78+
Branch: REL_11_STABLE [e7154b6ac] 2018-08-04 19:38:58 -0400
79+
Branch: REL_10_STABLE [f6a124d01] 2018-08-04 19:38:58 -0400
80+
Branch: REL9_6_STABLE [b484bffe7] 2018-08-04 19:38:58 -0400
81+
Branch: REL9_5_STABLE [5ad143cda] 2018-08-04 19:38:59 -0400
82+
-->
83+
<para>
84+
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
85+
that isn't just <literal>SELECT * FROM ...</literal>
86+
(Dean Rasheed, Amit Langote)
87+
</para>
88+
89+
<para>
90+
Erroneous expansion of an updatable view could lead to crashes
91+
or <quote>attribute ... has the wrong type</quote> errors, if the
92+
view's <literal>SELECT</literal> list doesn't match one-to-one with
93+
the underlying table's columns.
94+
Furthermore, this bug could be leveraged to allow updates of columns
95+
that an attacking user lacks <literal>UPDATE</literal> privilege for,
96+
if that user has <literal>INSERT</literal> and <literal>UPDATE</literal>
97+
privileges for some other column(s) of the table.
98+
Any user could also use it for disclosure of server memory.
99+
(CVE-2018-10925)
100+
</para>
101+
</listitem>
102+
103+
<listitem>
104+
<!--
38105
Author: Andres Freund <andres@anarazel.de>
39106
Branch: master Release: REL_11_BR [a54e1f158] 2018-06-12 11:13:21 -0700
40107
Branch: REL_10_STABLE [2ce64caaf] 2018-06-12 11:13:21 -0700
@@ -260,29 +327,6 @@ Branch: REL_10_STABLE [4beb25c63] 2018-07-16 17:55:13 -0400
260327

261328
<listitem>
262329
<!--
263-
Author: Tom Lane <tgl@sss.pgh.pa.us>
264-
Branch: master [b8a1247a3] 2018-08-04 19:38:58 -0400
265-
Branch: REL_11_STABLE [e7154b6ac] 2018-08-04 19:38:58 -0400
266-
Branch: REL_10_STABLE [f6a124d01] 2018-08-04 19:38:58 -0400
267-
Branch: REL9_6_STABLE [b484bffe7] 2018-08-04 19:38:58 -0400
268-
Branch: REL9_5_STABLE [5ad143cda] 2018-08-04 19:38:59 -0400
269-
-->
270-
<para>
271-
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
272-
that isn't just <literal>SELECT * FROM ...</literal>
273-
(Dean Rasheed, Amit Langote)
274-
</para>
275-
276-
<para>
277-
Erroneous expansion of an updatable view could lead to crashes
278-
or <quote>attribute ... has the wrong type</quote> errors, if the
279-
view's <literal>SELECT</literal> list doesn't match one-to-one with
280-
the underlying table's columns.
281-
</para>
282-
</listitem>
283-
284-
<listitem>
285-
<!--
286330
Author: Peter Geoghegan <pg@bowt.ie>
287331
Branch: master [b3f919da0] 2018-08-03 15:11:31 -0700
288332
Branch: REL_11_STABLE [b9612e5cf] 2018-08-03 14:45:02 -0700

‎doc/src/sgml/release-9.3.sgml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,34 @@
3939

4040
<itemizedlist>
4141

42+
<listitem>
43+
<para>
44+
Fix failure to reset <application>libpq</application>'s state fully
45+
between connection attempts (Tom Lane)
46+
</para>
47+
48+
<para>
49+
An unprivileged user of <filename>dblink</filename>
50+
or <filename>postgres_fdw</filename> could bypass the checks intended
51+
to prevent use of server-side credentials, such as
52+
a <filename>~/.pgpass</filename> file owned by the operating-system
53+
user running the server. Servers allowing peer authentication on
54+
local connections are particularly vulnerable. Other attacks such
55+
as SQL injection into a <filename>postgres_fdw</filename> session
56+
are also possible.
57+
Attacking <filename>postgres_fdw</filename> in this way requires the
58+
ability to create a foreign server object with selected connection
59+
parameters, but any user with access to <filename>dblink</filename>
60+
could exploit the problem.
61+
In general, an attacker with the ability to select the connection
62+
parameters for a <application>libpq</application>-using application
63+
could cause mischief, though other plausible attack scenarios are
64+
harder to think of.
65+
Our thanks to Andrew Krasichkov for reporting this issue.
66+
(CVE-2018-10915)
67+
</para>
68+
</listitem>
69+
4270
<listitem>
4371
<para>
4472
Ensure that updates to the <structfield>relfrozenxid</structfield>

‎doc/src/sgml/release-9.4.sgml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,34 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix failure to reset <application>libpq</application>'s state fully
39+
between connection attempts (Tom Lane)
40+
</para>
41+
42+
<para>
43+
An unprivileged user of <filename>dblink</filename>
44+
or <filename>postgres_fdw</filename> could bypass the checks intended
45+
to prevent use of server-side credentials, such as
46+
a <filename>~/.pgpass</filename> file owned by the operating-system
47+
user running the server. Servers allowing peer authentication on
48+
local connections are particularly vulnerable. Other attacks such
49+
as SQL injection into a <filename>postgres_fdw</filename> session
50+
are also possible.
51+
Attacking <filename>postgres_fdw</filename> in this way requires the
52+
ability to create a foreign server object with selected connection
53+
parameters, but any user with access to <filename>dblink</filename>
54+
could exploit the problem.
55+
In general, an attacker with the ability to select the connection
56+
parameters for a <application>libpq</application>-using application
57+
could cause mischief, though other plausible attack scenarios are
58+
harder to think of.
59+
Our thanks to Andrew Krasichkov for reporting this issue.
60+
(CVE-2018-10915)
61+
</para>
62+
</listitem>
63+
3664
<listitem>
3765
<para>
3866
Ensure that updates to the <structfield>relfrozenxid</structfield>

‎doc/src/sgml/release-9.5.sgml

Lines changed: 49 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,55 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix failure to reset <application>libpq</application>'s state fully
39+
between connection attempts (Tom Lane)
40+
</para>
41+
42+
<para>
43+
An unprivileged user of <filename>dblink</filename>
44+
or <filename>postgres_fdw</filename> could bypass the checks intended
45+
to prevent use of server-side credentials, such as
46+
a <filename>~/.pgpass</filename> file owned by the operating-system
47+
user running the server. Servers allowing peer authentication on
48+
local connections are particularly vulnerable. Other attacks such
49+
as SQL injection into a <filename>postgres_fdw</filename> session
50+
are also possible.
51+
Attacking <filename>postgres_fdw</filename> in this way requires the
52+
ability to create a foreign server object with selected connection
53+
parameters, but any user with access to <filename>dblink</filename>
54+
could exploit the problem.
55+
In general, an attacker with the ability to select the connection
56+
parameters for a <application>libpq</application>-using application
57+
could cause mischief, though other plausible attack scenarios are
58+
harder to think of.
59+
Our thanks to Andrew Krasichkov for reporting this issue.
60+
(CVE-2018-10915)
61+
</para>
62+
</listitem>
63+
64+
<listitem>
65+
<para>
66+
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
67+
that isn't just <literal>SELECT * FROM ...</literal>
68+
(Dean Rasheed, Amit Langote)
69+
</para>
70+
71+
<para>
72+
Erroneous expansion of an updatable view could lead to crashes
73+
or <quote>attribute ... has the wrong type</quote> errors, if the
74+
view's <literal>SELECT</literal> list doesn't match one-to-one with
75+
the underlying table's columns.
76+
Furthermore, this bug could be leveraged to allow updates of columns
77+
that an attacking user lacks <literal>UPDATE</literal> privilege for,
78+
if that user has <literal>INSERT</literal> and <literal>UPDATE</literal>
79+
privileges for some other column(s) of the table.
80+
Any user could also use it for disclosure of server memory.
81+
(CVE-2018-10925)
82+
</para>
83+
</listitem>
84+
3685
<listitem>
3786
<para>
3887
Ensure that updates to the <structfield>relfrozenxid</structfield>
@@ -140,21 +189,6 @@
140189
</para>
141190
</listitem>
142191

143-
<listitem>
144-
<para>
145-
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
146-
that isn't just <literal>SELECT * FROM ...</literal>
147-
(Dean Rasheed, Amit Langote)
148-
</para>
149-
150-
<para>
151-
Erroneous expansion of an updatable view could lead to crashes
152-
or <quote>attribute ... has the wrong type</quote> errors, if the
153-
view's <literal>SELECT</literal> list doesn't match one-to-one with
154-
the underlying table's columns.
155-
</para>
156-
</listitem>
157-
158192
<listitem>
159193
<para>
160194
Ensure a table's cached index list is correctly rebuilt after an index

‎doc/src/sgml/release-9.6.sgml

Lines changed: 49 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,55 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix failure to reset <application>libpq</application>'s state fully
39+
between connection attempts (Tom Lane)
40+
</para>
41+
42+
<para>
43+
An unprivileged user of <filename>dblink</filename>
44+
or <filename>postgres_fdw</filename> could bypass the checks intended
45+
to prevent use of server-side credentials, such as
46+
a <filename>~/.pgpass</filename> file owned by the operating-system
47+
user running the server. Servers allowing peer authentication on
48+
local connections are particularly vulnerable. Other attacks such
49+
as SQL injection into a <filename>postgres_fdw</filename> session
50+
are also possible.
51+
Attacking <filename>postgres_fdw</filename> in this way requires the
52+
ability to create a foreign server object with selected connection
53+
parameters, but any user with access to <filename>dblink</filename>
54+
could exploit the problem.
55+
In general, an attacker with the ability to select the connection
56+
parameters for a <application>libpq</application>-using application
57+
could cause mischief, though other plausible attack scenarios are
58+
harder to think of.
59+
Our thanks to Andrew Krasichkov for reporting this issue.
60+
(CVE-2018-10915)
61+
</para>
62+
</listitem>
63+
64+
<listitem>
65+
<para>
66+
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
67+
that isn't just <literal>SELECT * FROM ...</literal>
68+
(Dean Rasheed, Amit Langote)
69+
</para>
70+
71+
<para>
72+
Erroneous expansion of an updatable view could lead to crashes
73+
or <quote>attribute ... has the wrong type</quote> errors, if the
74+
view's <literal>SELECT</literal> list doesn't match one-to-one with
75+
the underlying table's columns.
76+
Furthermore, this bug could be leveraged to allow updates of columns
77+
that an attacking user lacks <literal>UPDATE</literal> privilege for,
78+
if that user has <literal>INSERT</literal> and <literal>UPDATE</literal>
79+
privileges for some other column(s) of the table.
80+
Any user could also use it for disclosure of server memory.
81+
(CVE-2018-10925)
82+
</para>
83+
</listitem>
84+
3685
<listitem>
3786
<para>
3887
Ensure that updates to the <structfield>relfrozenxid</structfield>
@@ -140,21 +189,6 @@
140189
</para>
141190
</listitem>
142191

143-
<listitem>
144-
<para>
145-
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
146-
that isn't just <literal>SELECT * FROM ...</literal>
147-
(Dean Rasheed, Amit Langote)
148-
</para>
149-
150-
<para>
151-
Erroneous expansion of an updatable view could lead to crashes
152-
or <quote>attribute ... has the wrong type</quote> errors, if the
153-
view's <literal>SELECT</literal> list doesn't match one-to-one with
154-
the underlying table's columns.
155-
</para>
156-
</listitem>
157-
158192
<listitem>
159193
<para>
160194
Ensure a table's cached index list is correctly rebuilt after an index

0 commit comments

Comments
 (0)