Skip to content

Commit 90cf59c

Browse files
tglsfdctglsfdc
committed
Last-minute updates for release notes.
Security: CVE-2020-25694, CVE-2020-25695, CVE-2020-25696
1 parent f47841f commit 90cf59c

File tree

1 file changed

+143
-73
lines changed

1 file changed

+143
-73
lines changed

‎doc/src/sgml/release-13.sgml

Lines changed: 143 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,149 @@
3030

3131
<listitem>
3232
<!--
33+
Author: Noah Misch <noah@leadboat.com>
34+
Branch: master [0c3185e96] 2020-11-09 07:32:09 -0800
35+
Branch: REL_13_STABLE [c90c84b3f] 2020-11-09 07:32:12 -0800
36+
Branch: REL_12_STABLE [ac8f6243c] 2020-11-09 07:32:12 -0800
37+
Branch: REL_11_STABLE [43ebfea5a] 2020-11-09 07:32:13 -0800
38+
Branch: REL_10_STABLE [f97ecea1e] 2020-11-09 07:32:13 -0800
39+
Branch: REL9_6_STABLE [ff3de4c21] 2020-11-09 07:32:13 -0800
40+
Branch: REL9_5_STABLE [aefc625de] 2020-11-09 07:32:14 -0800
41+
-->
42+
<para>
43+
Block <command>DECLARE CURSOR ... WITH HOLD</command> and firing of
44+
deferred triggers within index expressions and materialized view
45+
queries (Noah Misch)
46+
</para>
47+
48+
<para>
49+
This is essentially a leak in the <quote>security restricted
50+
operation</quote> sandbox mechanism. An attacker having permission
51+
to create non-temporary SQL objects could parlay this leak to
52+
execute arbitrary SQL code as a superuser.
53+
</para>
54+
55+
<para>
56+
The <productname>PostgreSQL</productname> Project thanks
57+
Etienne Stalmans for reporting this problem.
58+
(CVE-2020-25695)
59+
</para>
60+
</listitem>
61+
62+
<listitem>
63+
<!--
64+
Author: Tom Lane <tgl@sss.pgh.pa.us>
65+
Branch: master [a45bc8a4f] 2020-09-24 18:19:38 -0400
66+
Branch: REL_13_STABLE [cb8885ac4] 2020-09-24 18:19:38 -0400
67+
Branch: REL_12_STABLE [fb93f784f] 2020-09-24 18:19:38 -0400
68+
Branch: REL_11_STABLE [1738a61c8] 2020-09-24 18:19:39 -0400
69+
Branch: REL_10_STABLE [1888ff8d0] 2020-09-24 18:19:39 -0400
70+
Branch: REL9_6_STABLE [7c154f2fd] 2020-09-24 18:19:39 -0400
71+
Branch: REL9_5_STABLE [56b46d3a1] 2020-09-24 18:19:39 -0400
72+
Branch: master [8e5793ab6] 2020-10-19 19:03:46 -0400
73+
Branch: REL_13_STABLE [1814f915b] 2020-10-19 19:03:46 -0400
74+
Branch: REL_12_STABLE [c6d0b9b16] 2020-10-19 19:03:46 -0400
75+
Branch: REL_11_STABLE [5a9f99bed] 2020-10-19 19:03:47 -0400
76+
Branch: REL_10_STABLE [68f236993] 2020-10-19 19:03:47 -0400
77+
Branch: REL9_6_STABLE [5c78f7977] 2020-10-19 19:03:47 -0400
78+
Branch: REL9_5_STABLE [da129a04a] 2020-10-19 19:03:47 -0400
79+
-->
80+
<para>
81+
Fix usage of complex connection-string parameters
82+
in <application>pg_dump</application>,
83+
<application>pg_restore</application>,
84+
<application>clusterdb</application>,
85+
<application>reindexdb</application>,
86+
and <application>vacuumdb</application> (Tom Lane)
87+
</para>
88+
89+
<para>
90+
The <option>-d</option> parameter
91+
of <application>pg_dump</application>
92+
and <application>pg_restore</application>, or
93+
the <option>--maintenance-db</option> parameter of the other
94+
programs mentioned, can be a <quote>connection string</quote>
95+
containing multiple connection parameters rather than just a
96+
database name. In cases where these programs need to initiate
97+
additional connections, such as parallel processing or processing of
98+
multiple databases, the connection string was forgotten and just the
99+
basic connection parameters (database name, host, port, and
100+
username) were used for the additional connections. This could lead
101+
to connection failures if the connection string included any other
102+
essential information, such as non-default SSL or GSS parameters.
103+
Worse, the connection might succeed but not be encrypted as
104+
intended, or be vulnerable to man-in-the-middle attacks that the
105+
intended connection parameters would have prevented.
106+
(CVE-2020-25694)
107+
</para>
108+
</listitem>
109+
110+
<listitem>
111+
<!--
112+
Author: Tom Lane <tgl@sss.pgh.pa.us>
113+
Branch: master [85c54287a] 2020-10-21 16:19:00 -0400
114+
Branch: REL_13_STABLE [2e4af4110] 2020-10-21 16:19:00 -0400
115+
Branch: REL_12_STABLE [f656517ec] 2020-10-21 16:19:01 -0400
116+
Branch: REL_11_STABLE [20be76d5c] 2020-10-21 16:19:01 -0400
117+
Branch: REL_10_STABLE [8175da6e7] 2020-10-21 16:19:02 -0400
118+
Branch: REL9_6_STABLE [870a23230] 2020-10-21 16:18:41 -0400
119+
Branch: REL9_5_STABLE [6997da09a] 2020-10-21 16:18:41 -0400
120+
-->
121+
<para>
122+
When <application>psql</application>'s <command>\connect</command>
123+
command re-uses connection parameters, ensure that all
124+
non-overridden parameters from a previous connection string are
125+
re-used (Tom Lane)
126+
</para>
127+
128+
<para>
129+
This avoids cases where reconnection might fail due to omission of
130+
relevant parameters, such as non-default SSL or GSS options.
131+
Worse, the reconnection might succeed but not be encrypted as
132+
intended, or be vulnerable to man-in-the-middle attacks that the
133+
intended connection parameters would have prevented.
134+
This is largely the same problem as just cited
135+
for <application>pg_dump</application> et al,
136+
although <application>psql</application>'s behavior is more complex
137+
since the user may intentionally override some connection
138+
parameters.
139+
(CVE-2020-25694)
140+
</para>
141+
</listitem>
142+
143+
<listitem>
144+
<!--
145+
Author: Noah Misch <noah@leadboat.com>
146+
Branch: master [098fb0079] 2020-11-09 07:32:09 -0800
147+
Branch: REL_13_STABLE [67029845b] 2020-11-09 07:32:12 -0800
148+
Branch: REL_12_STABLE [3855e5b47] 2020-11-09 07:32:13 -0800
149+
Branch: REL_11_STABLE [7b356c78f] 2020-11-09 07:32:13 -0800
150+
Branch: REL_10_STABLE [a498db87b] 2020-11-09 07:32:13 -0800
151+
Branch: REL9_6_STABLE [12fd81cb7] 2020-11-09 07:32:14 -0800
152+
Branch: REL9_5_STABLE [a54dfbee1] 2020-11-09 07:32:14 -0800
153+
-->
154+
<para>
155+
Prevent <application>psql</application>'s <command>\gset</command>
156+
command from modifying specially-treated variables (Noah Misch)
157+
</para>
158+
159+
<para>
160+
<command>\gset</command> without a prefix would overwrite whatever
161+
variables the server told it to. Thus, a compromised server could
162+
set specially-treated variables such as <varname>PROMPT1</varname>,
163+
giving the ability to execute arbitrary shell code in the user's
164+
session.
165+
</para>
166+
167+
<para>
168+
The <productname>PostgreSQL</productname> Project thanks
169+
Nick Cleaton for reporting this problem.
170+
(CVE-2020-25696)
171+
</para>
172+
</listitem>
173+
174+
<listitem>
175+
<!--
33176
Author: Alvaro Herrera <alvherre@alvh.no-ip.org>
34177
Branch: master [4e9821b6f] 2020-10-14 20:12:26 -0300
35178
Branch: REL_13_STABLE [72e43fc31] 2020-10-14 20:12:26 -0300
@@ -722,79 +865,6 @@ Branch: REL9_5_STABLE [aff06436c] 2020-10-28 14:35:53 -0400
722865

723866
<listitem>
724867
<!--
725-
Author: Tom Lane <tgl@sss.pgh.pa.us>
726-
Branch: master [a45bc8a4f] 2020-09-24 18:19:38 -0400
727-
Branch: REL_13_STABLE [cb8885ac4] 2020-09-24 18:19:38 -0400
728-
Branch: REL_12_STABLE [fb93f784f] 2020-09-24 18:19:38 -0400
729-
Branch: REL_11_STABLE [1738a61c8] 2020-09-24 18:19:39 -0400
730-
Branch: REL_10_STABLE [1888ff8d0] 2020-09-24 18:19:39 -0400
731-
Branch: REL9_6_STABLE [7c154f2fd] 2020-09-24 18:19:39 -0400
732-
Branch: REL9_5_STABLE [56b46d3a1] 2020-09-24 18:19:39 -0400
733-
Branch: master [8e5793ab6] 2020-10-19 19:03:46 -0400
734-
Branch: REL_13_STABLE [1814f915b] 2020-10-19 19:03:46 -0400
735-
Branch: REL_12_STABLE [c6d0b9b16] 2020-10-19 19:03:46 -0400
736-
Branch: REL_11_STABLE [5a9f99bed] 2020-10-19 19:03:47 -0400
737-
Branch: REL_10_STABLE [68f236993] 2020-10-19 19:03:47 -0400
738-
Branch: REL9_6_STABLE [5c78f7977] 2020-10-19 19:03:47 -0400
739-
Branch: REL9_5_STABLE [da129a04a] 2020-10-19 19:03:47 -0400
740-
-->
741-
<para>
742-
Fix usage of complex connection-string parameters
743-
in <application>pg_dump</application>,
744-
<application>pg_restore</application>,
745-
<application>clusterdb</application>,
746-
<application>reindexdb</application>,
747-
and <application>vacuumdb</application> (Tom Lane)
748-
</para>
749-
750-
<para>
751-
The <option>-d</option> parameter
752-
of <application>pg_dump</application>
753-
and <application>pg_restore</application>, or
754-
the <option>--maintenance-db</option> parameter of the other
755-
programs mentioned, can be a <quote>connection string</quote>
756-
containing multiple connection parameters rather than just a
757-
database name. In cases where these programs need to initiate
758-
additional connections, such as parallel processing or processing of
759-
multiple databases, the connection string was forgotten and just the
760-
basic connection parameters (database name, host, port, and
761-
username) were used for the additional connections. This could lead
762-
to connection failures if the connection string included any other
763-
essential information, such as non-default SSL or GSS parameters.
764-
</para>
765-
</listitem>
766-
767-
<listitem>
768-
<!--
769-
Author: Tom Lane <tgl@sss.pgh.pa.us>
770-
Branch: master [85c54287a] 2020-10-21 16:19:00 -0400
771-
Branch: REL_13_STABLE [2e4af4110] 2020-10-21 16:19:00 -0400
772-
Branch: REL_12_STABLE [f656517ec] 2020-10-21 16:19:01 -0400
773-
Branch: REL_11_STABLE [20be76d5c] 2020-10-21 16:19:01 -0400
774-
Branch: REL_10_STABLE [8175da6e7] 2020-10-21 16:19:02 -0400
775-
Branch: REL9_6_STABLE [870a23230] 2020-10-21 16:18:41 -0400
776-
Branch: REL9_5_STABLE [6997da09a] 2020-10-21 16:18:41 -0400
777-
-->
778-
<para>
779-
When <application>psql</application>'s <command>\connect</command>
780-
command re-uses connection parameters, ensure that all
781-
non-overridden parameters from a previous connection string are
782-
re-used (Tom Lane)
783-
</para>
784-
785-
<para>
786-
This avoids cases where reconnection might fail due to omission of
787-
relevant parameters, such as non-default SSL or GSS options. This
788-
is largely the same problem as just cited
789-
for <application>pg_dump</application> et al,
790-
although <application>psql</application>'s behavior is more complex
791-
since the user may intentionally override some connection
792-
parameters.
793-
</para>
794-
</listitem>
795-
796-
<listitem>
797-
<!--
798868
Author: Andrew Dunstan <andrew@dunslane.net>
799869
Branch: master [3eb3d3e78] 2020-09-04 13:54:54 -0400
800870
Branch: REL_13_STABLE Release: REL_13_0 [72857482c] 2020-09-04 13:55:11 -0400

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy