Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitcbe0dd5

Browse files
committed
Last-minute updates for release notes.
Security:CVE-2018-1052,CVE-2018-1053
1 parentdc6fb45 commitcbe0dd5

File tree

5 files changed

+137
-0
lines changed

5 files changed

+137
-0
lines changed

‎doc/src/sgml/release-10.sgml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,55 @@
4141

4242
<listitem>
4343
<!--
44+
Author: Tom Lane <tgl@sss.pgh.pa.us>
45+
Branch: master [3492a0af0] 2018-02-05 10:37:30 -0500
46+
Branch: REL_10_STABLE [fe921a360] 2018-02-05 10:37:30 -0500
47+
-->
48+
<para>
49+
Fix processing of partition keys containing multiple expressions
50+
(&Aacute;lvaro Herrera, David Rowley)
51+
</para>
52+
53+
<para>
54+
This error led to crashes or, with carefully crafted input, disclosure
55+
of arbitrary backend memory.
56+
(CVE-2018-1052)
57+
</para>
58+
</listitem>
59+
60+
<listitem>
61+
<!--
62+
Author: Tom Lane <tgl@sss.pgh.pa.us>
63+
Branch: master [a926eb84e] 2018-02-05 10:58:27 -0500
64+
Branch: REL_10_STABLE [6ba52aeb2] 2018-02-05 10:58:27 -0500
65+
Branch: REL9_6_STABLE [1341e017d] 2018-02-05 10:58:27 -0500
66+
Branch: REL9_5_STABLE [17aa02368] 2018-02-05 10:58:27 -0500
67+
Branch: REL9_4_STABLE [c3456208d] 2018-02-05 10:58:27 -0500
68+
Branch: REL9_3_STABLE [9c59e48a2] 2018-02-05 10:58:27 -0500
69+
-->
70+
<para>
71+
Ensure that all temporary files made
72+
by <application>pg_upgrade</application> are non-world-readable
73+
(Tom Lane, Noah Misch)
74+
</para>
75+
76+
<para>
77+
<application>pg_upgrade</application> normally restricts its
78+
temporary files to be readable and writable only by the calling user.
79+
But the temporary file containing <literal>pg_dumpall -g</literal>
80+
output would be group- or world-readable, or even writable, if the
81+
user's <literal>umask</literal> setting allows. In typical usage on
82+
multi-user machines, the <literal>umask</literal> and/or the working
83+
directory's permissions would be tight enough to prevent problems;
84+
but there may be people using <application>pg_upgrade</application>
85+
in scenarios where this oversight would permit disclosure of database
86+
passwords to unfriendly eyes.
87+
(CVE-2018-1053)
88+
</para>
89+
</listitem>
90+
91+
<listitem>
92+
<!--
4493
Author: Andres Freund <andres@anarazel.de>
4594
Branch: master [9c2f0a6c3] 2017-12-14 18:20:47 -0800
4695
Branch: REL_10_STABLE [1224383e8] 2017-12-14 18:20:48 -0800

‎doc/src/sgml/release-9.3.sgml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,28 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Ensure that all temporary files made
39+
by <application>pg_upgrade</application> are non-world-readable
40+
(Tom Lane, Noah Misch)
41+
</para>
42+
43+
<para>
44+
<application>pg_upgrade</application> normally restricts its
45+
temporary files to be readable and writable only by the calling user.
46+
But the temporary file containing <literal>pg_dumpall -g</literal>
47+
output would be group- or world-readable, or even writable, if the
48+
user's <literal>umask</literal> setting allows. In typical usage on
49+
multi-user machines, the <literal>umask</literal> and/or the working
50+
directory's permissions would be tight enough to prevent problems;
51+
but there may be people using <application>pg_upgrade</application>
52+
in scenarios where this oversight would permit disclosure of database
53+
passwords to unfriendly eyes.
54+
(CVE-2018-1053)
55+
</para>
56+
</listitem>
57+
3658
<listitem>
3759
<para>
3860
Fix vacuuming of tuples that were updated while key-share locked

‎doc/src/sgml/release-9.4.sgml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,28 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Ensure that all temporary files made
39+
by <application>pg_upgrade</application> are non-world-readable
40+
(Tom Lane, Noah Misch)
41+
</para>
42+
43+
<para>
44+
<application>pg_upgrade</application> normally restricts its
45+
temporary files to be readable and writable only by the calling user.
46+
But the temporary file containing <literal>pg_dumpall -g</literal>
47+
output would be group- or world-readable, or even writable, if the
48+
user's <literal>umask</literal> setting allows. In typical usage on
49+
multi-user machines, the <literal>umask</literal> and/or the working
50+
directory's permissions would be tight enough to prevent problems;
51+
but there may be people using <application>pg_upgrade</application>
52+
in scenarios where this oversight would permit disclosure of database
53+
passwords to unfriendly eyes.
54+
(CVE-2018-1053)
55+
</para>
56+
</listitem>
57+
3658
<listitem>
3759
<para>
3860
Fix vacuuming of tuples that were updated while key-share locked

‎doc/src/sgml/release-9.5.sgml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,28 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Ensure that all temporary files made
39+
by <application>pg_upgrade</application> are non-world-readable
40+
(Tom Lane, Noah Misch)
41+
</para>
42+
43+
<para>
44+
<application>pg_upgrade</application> normally restricts its
45+
temporary files to be readable and writable only by the calling user.
46+
But the temporary file containing <literal>pg_dumpall -g</literal>
47+
output would be group- or world-readable, or even writable, if the
48+
user's <literal>umask</literal> setting allows. In typical usage on
49+
multi-user machines, the <literal>umask</literal> and/or the working
50+
directory's permissions would be tight enough to prevent problems;
51+
but there may be people using <application>pg_upgrade</application>
52+
in scenarios where this oversight would permit disclosure of database
53+
passwords to unfriendly eyes.
54+
(CVE-2018-1053)
55+
</para>
56+
</listitem>
57+
3658
<listitem>
3759
<para>
3860
Fix vacuuming of tuples that were updated while key-share locked

‎doc/src/sgml/release-9.6.sgml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,28 @@
3939

4040
<itemizedlist>
4141

42+
<listitem>
43+
<para>
44+
Ensure that all temporary files made
45+
by <application>pg_upgrade</application> are non-world-readable
46+
(Tom Lane, Noah Misch)
47+
</para>
48+
49+
<para>
50+
<application>pg_upgrade</application> normally restricts its
51+
temporary files to be readable and writable only by the calling user.
52+
But the temporary file containing <literal>pg_dumpall -g</literal>
53+
output would be group- or world-readable, or even writable, if the
54+
user's <literal>umask</literal> setting allows. In typical usage on
55+
multi-user machines, the <literal>umask</literal> and/or the working
56+
directory's permissions would be tight enough to prevent problems;
57+
but there may be people using <application>pg_upgrade</application>
58+
in scenarios where this oversight would permit disclosure of database
59+
passwords to unfriendly eyes.
60+
(CVE-2018-1053)
61+
</para>
62+
</listitem>
63+
4264
<listitem>
4365
<para>
4466
Fix vacuuming of tuples that were updated while key-share locked

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp