|
41 | 41 |
|
42 | 42 | <listitem> |
43 | 43 | <!-- |
| 44 | +Author: Dean Rasheed <dean.a.rasheed@gmail.com> |
| 45 | +Branch: master [22424953c] 2025-08-11 09:03:11 +0100 |
| 46 | +Branch: REL_18_STABLE [64f77c6a6] 2025-08-11 09:07:36 +0100 |
| 47 | +Branch: REL_17_STABLE [a85eddab2] 2025-08-11 09:09:12 +0100 |
| 48 | +Branch: REL_16_STABLE [7e86da539] 2025-08-11 09:10:17 +0100 |
| 49 | +Branch: REL_15_STABLE [415badc13] 2025-08-11 09:11:02 +0100 |
| 50 | +Branch: REL_14_STABLE [afe38fb6a] 2025-08-11 09:12:09 +0100 |
| 51 | +Branch: REL_13_STABLE [533211ded] 2025-08-11 09:13:20 +0100 |
| 52 | +--> |
| 53 | + <para> |
| 54 | + Tighten security checks in planner estimation functions |
| 55 | + (Dean Rasheed) |
| 56 | + <ulink url="&commit_baseurl;533211ded">§</ulink> |
| 57 | + </para> |
| 58 | + |
| 59 | + <para> |
| 60 | + The fix for CVE-2017-7484, plus followup fixes, intended to prevent |
| 61 | + leaky functions from being applied to statistics data for columns |
| 62 | + that the calling user does not have permission to read. Two gaps in |
| 63 | + that protection have been found. One gap applies to partitioning |
| 64 | + and inheritance hierarchies where RLS policies on the tables should |
| 65 | + restrict access to statistics data, but did not. |
| 66 | + </para> |
| 67 | + |
| 68 | + <para> |
| 69 | + The other gap applies to cases where the query accesses a table via |
| 70 | + a view, and the view owner has permissions to read the underlying |
| 71 | + table but the calling user does not have permissions on the view. |
| 72 | + The view owner's permissions satisfied the security checks, and the |
| 73 | + leaky function would get applied to the underlying table's |
| 74 | + statistics before we check the calling user's permissions on the |
| 75 | + view. This has been fixed by making security checks on views occur |
| 76 | + at the start of planning. That might cause permissions failures to |
| 77 | + occur earlier than before. |
| 78 | + </para> |
| 79 | + |
| 80 | + <para> |
| 81 | + The <productname>PostgreSQL</productname> Project thanks |
| 82 | + Dean Rasheed for reporting this problem. |
| 83 | + (CVE-2025-8713) |
| 84 | + </para> |
| 85 | + </listitem> |
| 86 | + |
| 87 | + <listitem> |
| 88 | +<!-- |
| 89 | +Author: Nathan Bossart <nathan@postgresql.org> |
| 90 | +Branch: master [71ea0d679] 2025-08-11 09:00:00 -0500 |
| 91 | +Branch: REL_18_STABLE [67a2fbb8f] 2025-08-11 09:00:00 -0500 |
| 92 | +Branch: REL_17_STABLE [575f54d4c] 2025-08-11 09:00:00 -0500 |
| 93 | +Branch: REL_16_STABLE [7ad8e7909] 2025-08-11 09:00:00 -0500 |
| 94 | +Branch: REL_15_STABLE [424040506] 2025-08-11 09:00:00 -0500 |
| 95 | +Branch: REL_14_STABLE [e4998d089] 2025-08-11 09:00:00 -0500 |
| 96 | +Branch: REL_13_STABLE [c204bd39f] 2025-08-11 09:00:00 -0500 |
| 97 | +Branch: REL_14_STABLE [8967c33c6] 2025-08-11 12:37:00 -0500 |
| 98 | +Branch: REL_13_STABLE [27d3dee68] 2025-08-11 12:37:00 -0500 |
| 99 | +--> |
| 100 | + <para> |
| 101 | + Prevent <application>pg_dump</application> scripts from being used |
| 102 | + to attack the user running the restore (Nathan Bossart) |
| 103 | + <ulink url="&commit_baseurl;c204bd39f">§</ulink> |
| 104 | + <ulink url="&commit_baseurl;27d3dee68">§</ulink> |
| 105 | + </para> |
| 106 | + |
| 107 | + <para> |
| 108 | + Since dump/restore operations typically involve running SQL commands |
| 109 | + as superuser, the target database installation must trust the source |
| 110 | + server. However, it does not follow that the operating system user |
| 111 | + who executes <application>psql</application> to perform the restore |
| 112 | + should have to trust the source server. The risk here is that an |
| 113 | + attacker who has gained superuser-level control over the source |
| 114 | + server might be able to cause it to emit text that would be |
| 115 | + interpreted as <application>psql</application> meta-commands. |
| 116 | + That would provide shell-level access to the restoring user's own |
| 117 | + account, independently of access to the target database. |
| 118 | + </para> |
| 119 | + |
| 120 | + <para> |
| 121 | + To provide a positive guarantee that this can't happen, |
| 122 | + extend <application>psql</application> with |
| 123 | + a <command>\restrict</command> command that prevents execution of |
| 124 | + further meta-commands, and teach <application>pg_dump</application> |
| 125 | + to issue that before any data coming from the source server. |
| 126 | + </para> |
| 127 | + |
| 128 | + <para> |
| 129 | + The PostgreSQL Project thanks Martin Rakhmanov, Matthieu Denais, and |
| 130 | + RyotaK for reporting this problem. |
| 131 | + (CVE-2025-8714) |
| 132 | + </para> |
| 133 | + </listitem> |
| 134 | + |
| 135 | + <listitem> |
| 136 | +<!-- |
| 137 | +Author: Noah Misch <noah@leadboat.com> |
| 138 | +Branch: master [70693c645] 2025-08-11 06:18:59 -0700 |
| 139 | +Branch: REL_18_STABLE [13a67ce60] 2025-08-11 06:19:03 -0700 |
| 140 | +Branch: REL_17_STABLE [9b92f115b] 2025-08-11 06:19:03 -0700 |
| 141 | +Branch: REL_16_STABLE [850caae60] 2025-08-11 06:19:03 -0700 |
| 142 | +Branch: REL_15_STABLE [9751f934a] 2025-08-11 06:19:04 -0700 |
| 143 | +Branch: REL_14_STABLE [0f5838438] 2025-08-11 06:19:04 -0700 |
| 144 | +Branch: REL_13_STABLE [2179e6005] 2025-08-11 06:19:05 -0700 |
| 145 | +--> |
| 146 | + <para> |
| 147 | + Convert newlines to spaces in names included in comments |
| 148 | + in <application>pg_dump</application> output |
| 149 | + (Noah Misch) |
| 150 | + <ulink url="&commit_baseurl;2179e6005">§</ulink> |
| 151 | + </para> |
| 152 | + |
| 153 | + <para> |
| 154 | + Object names containing newlines offered the ability to inject |
| 155 | + arbitrary SQL commands into the output script. (Without the |
| 156 | + preceding fix, injection of <application>psql</application> |
| 157 | + meta-commands would also be possible this way.) |
| 158 | + CVE-2012-0868 fixed this class of problem at the time, but later |
| 159 | + work reintroduced several cases. |
| 160 | + </para> |
| 161 | + |
| 162 | + <para> |
| 163 | + The <productname>PostgreSQL</productname> Project thanks |
| 164 | + Noah Misch for reporting this problem. |
| 165 | + (CVE-2025-8715) |
| 166 | + </para> |
| 167 | + </listitem> |
| 168 | + |
| 169 | + <listitem> |
| 170 | +<!-- |
44 | 171 | Author: Tom Lane <tgl@sss.pgh.pa.us> |
45 | 172 | Branch: master [71c0921b6] 2025-07-28 16:50:41 -0400 |
46 | 173 | Branch: REL_18_STABLE [637ead2e1] 2025-07-28 16:50:41 -0400 |
|