Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 90cf59c

Browse files
tglsfdctglsfdc
committed
Last-minute updates for release notes.
Security: CVE-2020-25694, CVE-2020-25695, CVE-2020-25696
1 parent f47841f commit 90cf59c

File tree

1 file changed

+143
-73
lines changed

1 file changed

+143
-73
lines changed

‎doc/src/sgml/release-13.sgml

Lines changed: 143 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,149 @@
3030

3131
<listitem>
3232
<!--
33+
Author: Noah Misch <noah@leadboat.com>
34+
Branch: master [0c3185e96] 2020-11-09 07:32:09 -0800
35+
Branch: REL_13_STABLE [c90c84b3f] 2020-11-09 07:32:12 -0800
36+
Branch: REL_12_STABLE [ac8f6243c] 2020-11-09 07:32:12 -0800
37+
Branch: REL_11_STABLE [43ebfea5a] 2020-11-09 07:32:13 -0800
38+
Branch: REL_10_STABLE [f97ecea1e] 2020-11-09 07:32:13 -0800
39+
Branch: REL9_6_STABLE [ff3de4c21] 2020-11-09 07:32:13 -0800
40+
Branch: REL9_5_STABLE [aefc625de] 2020-11-09 07:32:14 -0800
41+
-->
42+
<para>
43+
Block <command>DECLARE CURSOR ... WITH HOLD</command> and firing of
44+
deferred triggers within index expressions and materialized view
45+
queries (Noah Misch)
46+
</para>
47+
48+
<para>
49+
This is essentially a leak in the <quote>security restricted
50+
operation</quote> sandbox mechanism. An attacker having permission
51+
to create non-temporary SQL objects could parlay this leak to
52+
execute arbitrary SQL code as a superuser.
53+
</para>
54+
55+
<para>
56+
The <productname>PostgreSQL</productname> Project thanks
57+
Etienne Stalmans for reporting this problem.
58+
(CVE-2020-25695)
59+
</para>
60+
</listitem>
61+
62+
<listitem>
63+
<!--
64+
Author: Tom Lane <tgl@sss.pgh.pa.us>
65+
Branch: master [a45bc8a4f] 2020-09-24 18:19:38 -0400
66+
Branch: REL_13_STABLE [cb8885ac4] 2020-09-24 18:19:38 -0400
67+
Branch: REL_12_STABLE [fb93f784f] 2020-09-24 18:19:38 -0400
68+
Branch: REL_11_STABLE [1738a61c8] 2020-09-24 18:19:39 -0400
69+
Branch: REL_10_STABLE [1888ff8d0] 2020-09-24 18:19:39 -0400
70+
Branch: REL9_6_STABLE [7c154f2fd] 2020-09-24 18:19:39 -0400
71+
Branch: REL9_5_STABLE [56b46d3a1] 2020-09-24 18:19:39 -0400
72+
Branch: master [8e5793ab6] 2020-10-19 19:03:46 -0400
73+
Branch: REL_13_STABLE [1814f915b] 2020-10-19 19:03:46 -0400
74+
Branch: REL_12_STABLE [c6d0b9b16] 2020-10-19 19:03:46 -0400
75+
Branch: REL_11_STABLE [5a9f99bed] 2020-10-19 19:03:47 -0400
76+
Branch: REL_10_STABLE [68f236993] 2020-10-19 19:03:47 -0400
77+
Branch: REL9_6_STABLE [5c78f7977] 2020-10-19 19:03:47 -0400
78+
Branch: REL9_5_STABLE [da129a04a] 2020-10-19 19:03:47 -0400
79+
-->
80+
<para>
81+
Fix usage of complex connection-string parameters
82+
in <application>pg_dump</application>,
83+
<application>pg_restore</application>,
84+
<application>clusterdb</application>,
85+
<application>reindexdb</application>,
86+
and <application>vacuumdb</application> (Tom Lane)
87+
</para>
88+
89+
<para>
90+
The <option>-d</option> parameter
91+
of <application>pg_dump</application>
92+
and <application>pg_restore</application>, or
93+
the <option>--maintenance-db</option> parameter of the other
94+
programs mentioned, can be a <quote>connection string</quote>
95+
containing multiple connection parameters rather than just a
96+
database name. In cases where these programs need to initiate
97+
additional connections, such as parallel processing or processing of
98+
multiple databases, the connection string was forgotten and just the
99+
basic connection parameters (database name, host, port, and
100+
username) were used for the additional connections. This could lead
101+
to connection failures if the connection string included any other
102+
essential information, such as non-default SSL or GSS parameters.
103+
Worse, the connection might succeed but not be encrypted as
104+
intended, or be vulnerable to man-in-the-middle attacks that the
105+
intended connection parameters would have prevented.
106+
(CVE-2020-25694)
107+
</para>
108+
</listitem>
109+
110+
<listitem>
111+
<!--
112+
Author: Tom Lane <tgl@sss.pgh.pa.us>
113+
Branch: master [85c54287a] 2020-10-21 16:19:00 -0400
114+
Branch: REL_13_STABLE [2e4af4110] 2020-10-21 16:19:00 -0400
115+
Branch: REL_12_STABLE [f656517ec] 2020-10-21 16:19:01 -0400
116+
Branch: REL_11_STABLE [20be76d5c] 2020-10-21 16:19:01 -0400
117+
Branch: REL_10_STABLE [8175da6e7] 2020-10-21 16:19:02 -0400
118+
Branch: REL9_6_STABLE [870a23230] 2020-10-21 16:18:41 -0400
119+
Branch: REL9_5_STABLE [6997da09a] 2020-10-21 16:18:41 -0400
120+
-->
121+
<para>
122+
When <application>psql</application>'s <command>\connect</command>
123+
command re-uses connection parameters, ensure that all
124+
non-overridden parameters from a previous connection string are
125+
re-used (Tom Lane)
126+
</para>
127+
128+
<para>
129+
This avoids cases where reconnection might fail due to omission of
130+
relevant parameters, such as non-default SSL or GSS options.
131+
Worse, the reconnection might succeed but not be encrypted as
132+
intended, or be vulnerable to man-in-the-middle attacks that the
133+
intended connection parameters would have prevented.
134+
This is largely the same problem as just cited
135+
for <application>pg_dump</application> et al,
136+
although <application>psql</application>'s behavior is more complex
137+
since the user may intentionally override some connection
138+
parameters.
139+
(CVE-2020-25694)
140+
</para>
141+
</listitem>
142+
143+
<listitem>
144+
<!--
145+
Author: Noah Misch <noah@leadboat.com>
146+
Branch: master [098fb0079] 2020-11-09 07:32:09 -0800
147+
Branch: REL_13_STABLE [67029845b] 2020-11-09 07:32:12 -0800
148+
Branch: REL_12_STABLE [3855e5b47] 2020-11-09 07:32:13 -0800
149+
Branch: REL_11_STABLE [7b356c78f] 2020-11-09 07:32:13 -0800
150+
Branch: REL_10_STABLE [a498db87b] 2020-11-09 07:32:13 -0800
151+
Branch: REL9_6_STABLE [12fd81cb7] 2020-11-09 07:32:14 -0800
152+
Branch: REL9_5_STABLE [a54dfbee1] 2020-11-09 07:32:14 -0800
153+
-->
154+
<para>
155+
Prevent <application>psql</application>'s <command>\gset</command>
156+
command from modifying specially-treated variables (Noah Misch)
157+
</para>
158+
159+
<para>
160+
<command>\gset</command> without a prefix would overwrite whatever
161+
variables the server told it to. Thus, a compromised server could
162+
set specially-treated variables such as <varname>PROMPT1</varname>,
163+
giving the ability to execute arbitrary shell code in the user's
164+
session.
165+
</para>
166+
167+
<para>
168+
The <productname>PostgreSQL</productname> Project thanks
169+
Nick Cleaton for reporting this problem.
170+
(CVE-2020-25696)
171+
</para>
172+
</listitem>
173+
174+
<listitem>
175+
<!--
33176
Author: Alvaro Herrera <alvherre@alvh.no-ip.org>
34177
Branch: master [4e9821b6f] 2020-10-14 20:12:26 -0300
35178
Branch: REL_13_STABLE [72e43fc31] 2020-10-14 20:12:26 -0300
@@ -722,79 +865,6 @@ Branch: REL9_5_STABLE [aff06436c] 2020-10-28 14:35:53 -0400
722865

723866
<listitem>
724867
<!--
725-
Author: Tom Lane <tgl@sss.pgh.pa.us>
726-
Branch: master [a45bc8a4f] 2020-09-24 18:19:38 -0400
727-
Branch: REL_13_STABLE [cb8885ac4] 2020-09-24 18:19:38 -0400
728-
Branch: REL_12_STABLE [fb93f784f] 2020-09-24 18:19:38 -0400
729-
Branch: REL_11_STABLE [1738a61c8] 2020-09-24 18:19:39 -0400
730-
Branch: REL_10_STABLE [1888ff8d0] 2020-09-24 18:19:39 -0400
731-
Branch: REL9_6_STABLE [7c154f2fd] 2020-09-24 18:19:39 -0400
732-
Branch: REL9_5_STABLE [56b46d3a1] 2020-09-24 18:19:39 -0400
733-
Branch: master [8e5793ab6] 2020-10-19 19:03:46 -0400
734-
Branch: REL_13_STABLE [1814f915b] 2020-10-19 19:03:46 -0400
735-
Branch: REL_12_STABLE [c6d0b9b16] 2020-10-19 19:03:46 -0400
736-
Branch: REL_11_STABLE [5a9f99bed] 2020-10-19 19:03:47 -0400
737-
Branch: REL_10_STABLE [68f236993] 2020-10-19 19:03:47 -0400
738-
Branch: REL9_6_STABLE [5c78f7977] 2020-10-19 19:03:47 -0400
739-
Branch: REL9_5_STABLE [da129a04a] 2020-10-19 19:03:47 -0400
740-
-->
741-
<para>
742-
Fix usage of complex connection-string parameters
743-
in <application>pg_dump</application>,
744-
<application>pg_restore</application>,
745-
<application>clusterdb</application>,
746-
<application>reindexdb</application>,
747-
and <application>vacuumdb</application> (Tom Lane)
748-
</para>
749-
750-
<para>
751-
The <option>-d</option> parameter
752-
of <application>pg_dump</application>
753-
and <application>pg_restore</application>, or
754-
the <option>--maintenance-db</option> parameter of the other
755-
programs mentioned, can be a <quote>connection string</quote>
756-
containing multiple connection parameters rather than just a
757-
database name. In cases where these programs need to initiate
758-
additional connections, such as parallel processing or processing of
759-
multiple databases, the connection string was forgotten and just the
760-
basic connection parameters (database name, host, port, and
761-
username) were used for the additional connections. This could lead
762-
to connection failures if the connection string included any other
763-
essential information, such as non-default SSL or GSS parameters.
764-
</para>
765-
</listitem>
766-
767-
<listitem>
768-
<!--
769-
Author: Tom Lane <tgl@sss.pgh.pa.us>
770-
Branch: master [85c54287a] 2020-10-21 16:19:00 -0400
771-
Branch: REL_13_STABLE [2e4af4110] 2020-10-21 16:19:00 -0400
772-
Branch: REL_12_STABLE [f656517ec] 2020-10-21 16:19:01 -0400
773-
Branch: REL_11_STABLE [20be76d5c] 2020-10-21 16:19:01 -0400
774-
Branch: REL_10_STABLE [8175da6e7] 2020-10-21 16:19:02 -0400
775-
Branch: REL9_6_STABLE [870a23230] 2020-10-21 16:18:41 -0400
776-
Branch: REL9_5_STABLE [6997da09a] 2020-10-21 16:18:41 -0400
777-
-->
778-
<para>
779-
When <application>psql</application>'s <command>\connect</command>
780-
command re-uses connection parameters, ensure that all
781-
non-overridden parameters from a previous connection string are
782-
re-used (Tom Lane)
783-
</para>
784-
785-
<para>
786-
This avoids cases where reconnection might fail due to omission of
787-
relevant parameters, such as non-default SSL or GSS options. This
788-
is largely the same problem as just cited
789-
for <application>pg_dump</application> et al,
790-
although <application>psql</application>'s behavior is more complex
791-
since the user may intentionally override some connection
792-
parameters.
793-
</para>
794-
</listitem>
795-
796-
<listitem>
797-
<!--
798868
Author: Andrew Dunstan <andrew@dunslane.net>
799869
Branch: master [3eb3d3e78] 2020-09-04 13:54:54 -0400
800870
Branch: REL_13_STABLE Release: REL_13_0 [72857482c] 2020-09-04 13:55:11 -0400

0 commit comments

Comments
 (0)