Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 9b8271c

Browse files
tglsfdctglsfdc
committed
Last-minute updates for release notes.
Security: CVE-2016-5423, CVE-2016-5424
1 parent 9a46324 commit 9b8271c

File tree

5 files changed

+465
-0
lines changed

5 files changed

+465
-0
lines changed

‎doc/src/sgml/release-9.1.sgml

+80
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,72 @@
4040

4141
<itemizedlist>
4242

43+
<listitem>
44+
<para>
45+
Fix possible mis-evaluation of
46+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
47+
Linnakangas, Michael Paquier, Tom Lane)
48+
</para>
49+
50+
<para>
51+
A <literal>CASE</> expression appearing within the test value
52+
subexpression of another <literal>CASE</> could become confused about
53+
whether its own test value was null or not. Also, inlining of a SQL
54+
function implementing the equality operator used by
55+
a <literal>CASE</> expression could result in passing the wrong test
56+
value to functions called within a <literal>CASE</> expression in the
57+
SQL function's body. If the test values were of different data
58+
types, a crash might result; moreover such situations could be abused
59+
to allow disclosure of portions of server memory. (CVE-2016-5423)
60+
</para>
61+
</listitem>
62+
63+
<listitem>
64+
<para>
65+
Fix client programs' handling of special characters in database and
66+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
67+
</para>
68+
69+
<para>
70+
Numerous places in <application>vacuumdb</> and other client programs
71+
could become confused by database and role names containing double
72+
quotes or backslashes. Tighten up quoting rules to make that safe.
73+
Also, ensure that when a conninfo string is used as a database name
74+
parameter to these programs, it is correctly treated as such throughout.
75+
</para>
76+
77+
<para>
78+
Fix handling of paired double quotes
79+
in <application>psql</>'s <command>\connect</>
80+
and <command>\password</> commands to match the documentation.
81+
</para>
82+
83+
<para>
84+
Introduce a new <option>-reuse-previous</> option
85+
in <application>psql</>'s <command>\connect</> command to allow
86+
explicit control of whether to re-use connection parameters from a
87+
previous connection. (Without this, the choice is based on whether
88+
the database name looks like a conninfo string, as before.) This
89+
allows secure handling of database names containing special
90+
characters in <application>pg_dumpall</> scripts.
91+
</para>
92+
93+
<para>
94+
<application>pg_dumpall</> now refuses to deal with database and role
95+
names containing carriage returns or newlines, as it seems impractical
96+
to quote those characters safely on Windows. In future we may reject
97+
such names on the server side, but that step has not been taken yet.
98+
</para>
99+
100+
<para>
101+
These are considered security fixes because crafted object names
102+
containing special characters could have been used to execute
103+
commands with superuser privileges the next time a superuser
104+
executes <application>pg_dumpall</> or other routine maintenance
105+
operations. (CVE-2016-5424)
106+
</para>
107+
</listitem>
108+
43109
<listitem>
44110
<para>
45111
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -77,6 +143,20 @@
77143
</para>
78144
</listitem>
79145

146+
<listitem>
147+
<para>
148+
Fix several one-byte buffer over-reads in <function>to_number()</>
149+
(Peter Eisentraut)
150+
</para>
151+
152+
<para>
153+
In several cases the <function>to_number()</> function would read one
154+
more character than it should from the input string. There is a
155+
small chance of a crash, if the input happens to be adjacent to the
156+
end of memory.
157+
</para>
158+
</listitem>
159+
80160
<listitem>
81161
<para>
82162
Avoid unsafe intermediate state during expensive paths

‎doc/src/sgml/release-9.2.sgml

+80
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,72 @@
3434

3535
<itemizedlist>
3636

37+
<listitem>
38+
<para>
39+
Fix possible mis-evaluation of
40+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
41+
Linnakangas, Michael Paquier, Tom Lane)
42+
</para>
43+
44+
<para>
45+
A <literal>CASE</> expression appearing within the test value
46+
subexpression of another <literal>CASE</> could become confused about
47+
whether its own test value was null or not. Also, inlining of a SQL
48+
function implementing the equality operator used by
49+
a <literal>CASE</> expression could result in passing the wrong test
50+
value to functions called within a <literal>CASE</> expression in the
51+
SQL function's body. If the test values were of different data
52+
types, a crash might result; moreover such situations could be abused
53+
to allow disclosure of portions of server memory. (CVE-2016-5423)
54+
</para>
55+
</listitem>
56+
57+
<listitem>
58+
<para>
59+
Fix client programs' handling of special characters in database and
60+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
61+
</para>
62+
63+
<para>
64+
Numerous places in <application>vacuumdb</> and other client programs
65+
could become confused by database and role names containing double
66+
quotes or backslashes. Tighten up quoting rules to make that safe.
67+
Also, ensure that when a conninfo string is used as a database name
68+
parameter to these programs, it is correctly treated as such throughout.
69+
</para>
70+
71+
<para>
72+
Fix handling of paired double quotes
73+
in <application>psql</>'s <command>\connect</>
74+
and <command>\password</> commands to match the documentation.
75+
</para>
76+
77+
<para>
78+
Introduce a new <option>-reuse-previous</> option
79+
in <application>psql</>'s <command>\connect</> command to allow
80+
explicit control of whether to re-use connection parameters from a
81+
previous connection. (Without this, the choice is based on whether
82+
the database name looks like a conninfo string, as before.) This
83+
allows secure handling of database names containing special
84+
characters in <application>pg_dumpall</> scripts.
85+
</para>
86+
87+
<para>
88+
<application>pg_dumpall</> now refuses to deal with database and role
89+
names containing carriage returns or newlines, as it seems impractical
90+
to quote those characters safely on Windows. In future we may reject
91+
such names on the server side, but that step has not been taken yet.
92+
</para>
93+
94+
<para>
95+
These are considered security fixes because crafted object names
96+
containing special characters could have been used to execute
97+
commands with superuser privileges the next time a superuser
98+
executes <application>pg_dumpall</> or other routine maintenance
99+
operations. (CVE-2016-5424)
100+
</para>
101+
</listitem>
102+
37103
<listitem>
38104
<para>
39105
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -71,6 +137,20 @@
71137
</para>
72138
</listitem>
73139

140+
<listitem>
141+
<para>
142+
Fix several one-byte buffer over-reads in <function>to_number()</>
143+
(Peter Eisentraut)
144+
</para>
145+
146+
<para>
147+
In several cases the <function>to_number()</> function would read one
148+
more character than it should from the input string. There is a
149+
small chance of a crash, if the input happens to be adjacent to the
150+
end of memory.
151+
</para>
152+
</listitem>
153+
74154
<listitem>
75155
<para>
76156
Avoid unsafe intermediate state during expensive paths

‎doc/src/sgml/release-9.3.sgml

+80
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,72 @@
3434

3535
<itemizedlist>
3636

37+
<listitem>
38+
<para>
39+
Fix possible mis-evaluation of
40+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
41+
Linnakangas, Michael Paquier, Tom Lane)
42+
</para>
43+
44+
<para>
45+
A <literal>CASE</> expression appearing within the test value
46+
subexpression of another <literal>CASE</> could become confused about
47+
whether its own test value was null or not. Also, inlining of a SQL
48+
function implementing the equality operator used by
49+
a <literal>CASE</> expression could result in passing the wrong test
50+
value to functions called within a <literal>CASE</> expression in the
51+
SQL function's body. If the test values were of different data
52+
types, a crash might result; moreover such situations could be abused
53+
to allow disclosure of portions of server memory. (CVE-2016-5423)
54+
</para>
55+
</listitem>
56+
57+
<listitem>
58+
<para>
59+
Fix client programs' handling of special characters in database and
60+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
61+
</para>
62+
63+
<para>
64+
Numerous places in <application>vacuumdb</> and other client programs
65+
could become confused by database and role names containing double
66+
quotes or backslashes. Tighten up quoting rules to make that safe.
67+
Also, ensure that when a conninfo string is used as a database name
68+
parameter to these programs, it is correctly treated as such throughout.
69+
</para>
70+
71+
<para>
72+
Fix handling of paired double quotes
73+
in <application>psql</>'s <command>\connect</>
74+
and <command>\password</> commands to match the documentation.
75+
</para>
76+
77+
<para>
78+
Introduce a new <option>-reuse-previous</> option
79+
in <application>psql</>'s <command>\connect</> command to allow
80+
explicit control of whether to re-use connection parameters from a
81+
previous connection. (Without this, the choice is based on whether
82+
the database name looks like a conninfo string, as before.) This
83+
allows secure handling of database names containing special
84+
characters in <application>pg_dumpall</> scripts.
85+
</para>
86+
87+
<para>
88+
<application>pg_dumpall</> now refuses to deal with database and role
89+
names containing carriage returns or newlines, as it seems impractical
90+
to quote those characters safely on Windows. In future we may reject
91+
such names on the server side, but that step has not been taken yet.
92+
</para>
93+
94+
<para>
95+
These are considered security fixes because crafted object names
96+
containing special characters could have been used to execute
97+
commands with superuser privileges the next time a superuser
98+
executes <application>pg_dumpall</> or other routine maintenance
99+
operations. (CVE-2016-5424)
100+
</para>
101+
</listitem>
102+
37103
<listitem>
38104
<para>
39105
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -78,6 +144,20 @@
78144
</para>
79145
</listitem>
80146

147+
<listitem>
148+
<para>
149+
Fix several one-byte buffer over-reads in <function>to_number()</>
150+
(Peter Eisentraut)
151+
</para>
152+
153+
<para>
154+
In several cases the <function>to_number()</> function would read one
155+
more character than it should from the input string. There is a
156+
small chance of a crash, if the input happens to be adjacent to the
157+
end of memory.
158+
</para>
159+
</listitem>
160+
81161
<listitem>
82162
<para>
83163
Do not run the planner on the query contained in <literal>CREATE

‎doc/src/sgml/release-9.4.sgml

+80
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,72 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix possible mis-evaluation of
39+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
40+
Linnakangas, Michael Paquier, Tom Lane)
41+
</para>
42+
43+
<para>
44+
A <literal>CASE</> expression appearing within the test value
45+
subexpression of another <literal>CASE</> could become confused about
46+
whether its own test value was null or not. Also, inlining of a SQL
47+
function implementing the equality operator used by
48+
a <literal>CASE</> expression could result in passing the wrong test
49+
value to functions called within a <literal>CASE</> expression in the
50+
SQL function's body. If the test values were of different data
51+
types, a crash might result; moreover such situations could be abused
52+
to allow disclosure of portions of server memory. (CVE-2016-5423)
53+
</para>
54+
</listitem>
55+
56+
<listitem>
57+
<para>
58+
Fix client programs' handling of special characters in database and
59+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
60+
</para>
61+
62+
<para>
63+
Numerous places in <application>vacuumdb</> and other client programs
64+
could become confused by database and role names containing double
65+
quotes or backslashes. Tighten up quoting rules to make that safe.
66+
Also, ensure that when a conninfo string is used as a database name
67+
parameter to these programs, it is correctly treated as such throughout.
68+
</para>
69+
70+
<para>
71+
Fix handling of paired double quotes
72+
in <application>psql</>'s <command>\connect</>
73+
and <command>\password</> commands to match the documentation.
74+
</para>
75+
76+
<para>
77+
Introduce a new <option>-reuse-previous</> option
78+
in <application>psql</>'s <command>\connect</> command to allow
79+
explicit control of whether to re-use connection parameters from a
80+
previous connection. (Without this, the choice is based on whether
81+
the database name looks like a conninfo string, as before.) This
82+
allows secure handling of database names containing special
83+
characters in <application>pg_dumpall</> scripts.
84+
</para>
85+
86+
<para>
87+
<application>pg_dumpall</> now refuses to deal with database and role
88+
names containing carriage returns or newlines, as it seems impractical
89+
to quote those characters safely on Windows. In future we may reject
90+
such names on the server side, but that step has not been taken yet.
91+
</para>
92+
93+
<para>
94+
These are considered security fixes because crafted object names
95+
containing special characters could have been used to execute
96+
commands with superuser privileges the next time a superuser
97+
executes <application>pg_dumpall</> or other routine maintenance
98+
operations. (CVE-2016-5424)
99+
</para>
100+
</listitem>
101+
36102
<listitem>
37103
<para>
38104
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -77,6 +143,20 @@
77143
</para>
78144
</listitem>
79145

146+
<listitem>
147+
<para>
148+
Fix several one-byte buffer over-reads in <function>to_number()</>
149+
(Peter Eisentraut)
150+
</para>
151+
152+
<para>
153+
In several cases the <function>to_number()</> function would read one
154+
more character than it should from the input string. There is a
155+
small chance of a crash, if the input happens to be adjacent to the
156+
end of memory.
157+
</para>
158+
</listitem>
159+
80160
<listitem>
81161
<para>
82162
Do not run the planner on the query contained in <literal>CREATE

0 commit comments

Comments
 (0)