From 92d830f4bff643953a09563abaa106af42625207 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 6 Nov 2017 12:02:30 -0500 Subject: [PATCH] Last-minute updates for release notes. Security: CVE-2017-12172, CVE-2017-15098, CVE-2017-15099 --- doc/src/sgml/release-10.sgml | 108 +++++++++++++++++++++++++++++++++- doc/src/sgml/release-9.2.sgml | 25 ++++++++ doc/src/sgml/release-9.3.sgml | 42 +++++++++++++ doc/src/sgml/release-9.4.sgml | 42 +++++++++++++ doc/src/sgml/release-9.5.sgml | 75 ++++++++++++++++++++++- doc/src/sgml/release-9.6.sgml | 75 ++++++++++++++++++++++- 6 files changed, 364 insertions(+), 3 deletions(-) diff --git a/doc/src/sgml/release-10.sgml b/doc/src/sgml/release-10.sgml index 6c07157d294..30d602a053d 100644 --- a/doc/src/sgml/release-10.sgml +++ b/doc/src/sgml/release-10.sgml @@ -23,7 +23,7 @@ - However, if you use BRIN indexes, see the first changelog entry below. + However, if you use BRIN indexes, see the fourth changelog entry below. @@ -34,6 +34,92 @@ + + Ensure that INSERT ... ON CONFLICT DO UPDATE checks + table permissions and RLS policies in all cases (Dean Rasheed) + + + + The update path of INSERT ... ON CONFLICT DO UPDATE + requires SELECT permission on the columns of the + arbiter index, but it failed to check for that in the case of an + arbiter specified by constraint name. + In addition, for a table with row level security enabled, it failed to + check updated rows against the table's SELECT + policies (regardless of how the arbiter index was specified). + (CVE-2017-15099) + + + + + + + Fix crash due to rowtype mismatch + in json{b}_populate_recordset() + (Michael Paquier, Tom Lane) + + + + These functions used the result rowtype specified in the FROM + ... AS clause without checking that it matched the actual + rowtype of the supplied tuple value. If it didn't, that would usually + result in a crash, though disclosure of server memory contents seems + possible as well. + (CVE-2017-15098) + + + + + + + Fix sample server-start scripts to become $PGUSER + before opening $PGLOG (Noah Misch) + + + + Previously, the postmaster log file was opened while still running as + root. The database owner could therefore mount an attack against + another system user by making $PGLOG be a symbolic + link to some other file, which would then become corrupted by appending + log messages. + + + + By default, these scripts are not installed anywhere. Users who have + made use of them will need to manually recopy them, or apply the same + changes to their modified versions. If the + existing $PGLOG file is root-owned, it will need to + be removed or renamed out of the way before restarting the server with + the corrected script. + (CVE-2017-12172) + + + + + + + Fix missing temp-install prerequisites + for check-like Make targets (Noah Misch) + + + + Some non-default test procedures that are meant to work + like make check failed to ensure that the temporary + installation was up to date. + + + + +