Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2183966

Browse files
committed
Last-minute updates for release notes.
Security:CVE-2016-5423,CVE-2016-5424
1 parent04cee8f commit2183966

File tree

5 files changed

+465
-0
lines changed

5 files changed

+465
-0
lines changed

‎doc/src/sgml/release-9.1.sgml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,72 @@
4040

4141
<itemizedlist>
4242

43+
<listitem>
44+
<para>
45+
Fix possible mis-evaluation of
46+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
47+
Linnakangas, Michael Paquier, Tom Lane)
48+
</para>
49+
50+
<para>
51+
A <literal>CASE</> expression appearing within the test value
52+
subexpression of another <literal>CASE</> could become confused about
53+
whether its own test value was null or not. Also, inlining of a SQL
54+
function implementing the equality operator used by
55+
a <literal>CASE</> expression could result in passing the wrong test
56+
value to functions called within a <literal>CASE</> expression in the
57+
SQL function's body. If the test values were of different data
58+
types, a crash might result; moreover such situations could be abused
59+
to allow disclosure of portions of server memory. (CVE-2016-5423)
60+
</para>
61+
</listitem>
62+
63+
<listitem>
64+
<para>
65+
Fix client programs' handling of special characters in database and
66+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
67+
</para>
68+
69+
<para>
70+
Numerous places in <application>vacuumdb</> and other client programs
71+
could become confused by database and role names containing double
72+
quotes or backslashes. Tighten up quoting rules to make that safe.
73+
Also, ensure that when a conninfo string is used as a database name
74+
parameter to these programs, it is correctly treated as such throughout.
75+
</para>
76+
77+
<para>
78+
Fix handling of paired double quotes
79+
in <application>psql</>'s <command>\connect</>
80+
and <command>\password</> commands to match the documentation.
81+
</para>
82+
83+
<para>
84+
Introduce a new <option>-reuse-previous</> option
85+
in <application>psql</>'s <command>\connect</> command to allow
86+
explicit control of whether to re-use connection parameters from a
87+
previous connection. (Without this, the choice is based on whether
88+
the database name looks like a conninfo string, as before.) This
89+
allows secure handling of database names containing special
90+
characters in <application>pg_dumpall</> scripts.
91+
</para>
92+
93+
<para>
94+
<application>pg_dumpall</> now refuses to deal with database and role
95+
names containing carriage returns or newlines, as it seems impractical
96+
to quote those characters safely on Windows. In future we may reject
97+
such names on the server side, but that step has not been taken yet.
98+
</para>
99+
100+
<para>
101+
These are considered security fixes because crafted object names
102+
containing special characters could have been used to execute
103+
commands with superuser privileges the next time a superuser
104+
executes <application>pg_dumpall</> or other routine maintenance
105+
operations. (CVE-2016-5424)
106+
</para>
107+
</listitem>
108+
43109
<listitem>
44110
<para>
45111
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -77,6 +143,20 @@
77143
</para>
78144
</listitem>
79145

146+
<listitem>
147+
<para>
148+
Fix several one-byte buffer over-reads in <function>to_number()</>
149+
(Peter Eisentraut)
150+
</para>
151+
152+
<para>
153+
In several cases the <function>to_number()</> function would read one
154+
more character than it should from the input string. There is a
155+
small chance of a crash, if the input happens to be adjacent to the
156+
end of memory.
157+
</para>
158+
</listitem>
159+
80160
<listitem>
81161
<para>
82162
Avoid unsafe intermediate state during expensive paths

‎doc/src/sgml/release-9.2.sgml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,72 @@
3434

3535
<itemizedlist>
3636

37+
<listitem>
38+
<para>
39+
Fix possible mis-evaluation of
40+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
41+
Linnakangas, Michael Paquier, Tom Lane)
42+
</para>
43+
44+
<para>
45+
A <literal>CASE</> expression appearing within the test value
46+
subexpression of another <literal>CASE</> could become confused about
47+
whether its own test value was null or not. Also, inlining of a SQL
48+
function implementing the equality operator used by
49+
a <literal>CASE</> expression could result in passing the wrong test
50+
value to functions called within a <literal>CASE</> expression in the
51+
SQL function's body. If the test values were of different data
52+
types, a crash might result; moreover such situations could be abused
53+
to allow disclosure of portions of server memory. (CVE-2016-5423)
54+
</para>
55+
</listitem>
56+
57+
<listitem>
58+
<para>
59+
Fix client programs' handling of special characters in database and
60+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
61+
</para>
62+
63+
<para>
64+
Numerous places in <application>vacuumdb</> and other client programs
65+
could become confused by database and role names containing double
66+
quotes or backslashes. Tighten up quoting rules to make that safe.
67+
Also, ensure that when a conninfo string is used as a database name
68+
parameter to these programs, it is correctly treated as such throughout.
69+
</para>
70+
71+
<para>
72+
Fix handling of paired double quotes
73+
in <application>psql</>'s <command>\connect</>
74+
and <command>\password</> commands to match the documentation.
75+
</para>
76+
77+
<para>
78+
Introduce a new <option>-reuse-previous</> option
79+
in <application>psql</>'s <command>\connect</> command to allow
80+
explicit control of whether to re-use connection parameters from a
81+
previous connection. (Without this, the choice is based on whether
82+
the database name looks like a conninfo string, as before.) This
83+
allows secure handling of database names containing special
84+
characters in <application>pg_dumpall</> scripts.
85+
</para>
86+
87+
<para>
88+
<application>pg_dumpall</> now refuses to deal with database and role
89+
names containing carriage returns or newlines, as it seems impractical
90+
to quote those characters safely on Windows. In future we may reject
91+
such names on the server side, but that step has not been taken yet.
92+
</para>
93+
94+
<para>
95+
These are considered security fixes because crafted object names
96+
containing special characters could have been used to execute
97+
commands with superuser privileges the next time a superuser
98+
executes <application>pg_dumpall</> or other routine maintenance
99+
operations. (CVE-2016-5424)
100+
</para>
101+
</listitem>
102+
37103
<listitem>
38104
<para>
39105
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -71,6 +137,20 @@
71137
</para>
72138
</listitem>
73139

140+
<listitem>
141+
<para>
142+
Fix several one-byte buffer over-reads in <function>to_number()</>
143+
(Peter Eisentraut)
144+
</para>
145+
146+
<para>
147+
In several cases the <function>to_number()</> function would read one
148+
more character than it should from the input string. There is a
149+
small chance of a crash, if the input happens to be adjacent to the
150+
end of memory.
151+
</para>
152+
</listitem>
153+
74154
<listitem>
75155
<para>
76156
Avoid unsafe intermediate state during expensive paths

‎doc/src/sgml/release-9.3.sgml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,72 @@
3434

3535
<itemizedlist>
3636

37+
<listitem>
38+
<para>
39+
Fix possible mis-evaluation of
40+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
41+
Linnakangas, Michael Paquier, Tom Lane)
42+
</para>
43+
44+
<para>
45+
A <literal>CASE</> expression appearing within the test value
46+
subexpression of another <literal>CASE</> could become confused about
47+
whether its own test value was null or not. Also, inlining of a SQL
48+
function implementing the equality operator used by
49+
a <literal>CASE</> expression could result in passing the wrong test
50+
value to functions called within a <literal>CASE</> expression in the
51+
SQL function's body. If the test values were of different data
52+
types, a crash might result; moreover such situations could be abused
53+
to allow disclosure of portions of server memory. (CVE-2016-5423)
54+
</para>
55+
</listitem>
56+
57+
<listitem>
58+
<para>
59+
Fix client programs' handling of special characters in database and
60+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
61+
</para>
62+
63+
<para>
64+
Numerous places in <application>vacuumdb</> and other client programs
65+
could become confused by database and role names containing double
66+
quotes or backslashes. Tighten up quoting rules to make that safe.
67+
Also, ensure that when a conninfo string is used as a database name
68+
parameter to these programs, it is correctly treated as such throughout.
69+
</para>
70+
71+
<para>
72+
Fix handling of paired double quotes
73+
in <application>psql</>'s <command>\connect</>
74+
and <command>\password</> commands to match the documentation.
75+
</para>
76+
77+
<para>
78+
Introduce a new <option>-reuse-previous</> option
79+
in <application>psql</>'s <command>\connect</> command to allow
80+
explicit control of whether to re-use connection parameters from a
81+
previous connection. (Without this, the choice is based on whether
82+
the database name looks like a conninfo string, as before.) This
83+
allows secure handling of database names containing special
84+
characters in <application>pg_dumpall</> scripts.
85+
</para>
86+
87+
<para>
88+
<application>pg_dumpall</> now refuses to deal with database and role
89+
names containing carriage returns or newlines, as it seems impractical
90+
to quote those characters safely on Windows. In future we may reject
91+
such names on the server side, but that step has not been taken yet.
92+
</para>
93+
94+
<para>
95+
These are considered security fixes because crafted object names
96+
containing special characters could have been used to execute
97+
commands with superuser privileges the next time a superuser
98+
executes <application>pg_dumpall</> or other routine maintenance
99+
operations. (CVE-2016-5424)
100+
</para>
101+
</listitem>
102+
37103
<listitem>
38104
<para>
39105
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -78,6 +144,20 @@
78144
</para>
79145
</listitem>
80146

147+
<listitem>
148+
<para>
149+
Fix several one-byte buffer over-reads in <function>to_number()</>
150+
(Peter Eisentraut)
151+
</para>
152+
153+
<para>
154+
In several cases the <function>to_number()</> function would read one
155+
more character than it should from the input string. There is a
156+
small chance of a crash, if the input happens to be adjacent to the
157+
end of memory.
158+
</para>
159+
</listitem>
160+
81161
<listitem>
82162
<para>
83163
Do not run the planner on the query contained in <literal>CREATE

‎doc/src/sgml/release-9.4.sgml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,72 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix possible mis-evaluation of
39+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
40+
Linnakangas, Michael Paquier, Tom Lane)
41+
</para>
42+
43+
<para>
44+
A <literal>CASE</> expression appearing within the test value
45+
subexpression of another <literal>CASE</> could become confused about
46+
whether its own test value was null or not. Also, inlining of a SQL
47+
function implementing the equality operator used by
48+
a <literal>CASE</> expression could result in passing the wrong test
49+
value to functions called within a <literal>CASE</> expression in the
50+
SQL function's body. If the test values were of different data
51+
types, a crash might result; moreover such situations could be abused
52+
to allow disclosure of portions of server memory. (CVE-2016-5423)
53+
</para>
54+
</listitem>
55+
56+
<listitem>
57+
<para>
58+
Fix client programs' handling of special characters in database and
59+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
60+
</para>
61+
62+
<para>
63+
Numerous places in <application>vacuumdb</> and other client programs
64+
could become confused by database and role names containing double
65+
quotes or backslashes. Tighten up quoting rules to make that safe.
66+
Also, ensure that when a conninfo string is used as a database name
67+
parameter to these programs, it is correctly treated as such throughout.
68+
</para>
69+
70+
<para>
71+
Fix handling of paired double quotes
72+
in <application>psql</>'s <command>\connect</>
73+
and <command>\password</> commands to match the documentation.
74+
</para>
75+
76+
<para>
77+
Introduce a new <option>-reuse-previous</> option
78+
in <application>psql</>'s <command>\connect</> command to allow
79+
explicit control of whether to re-use connection parameters from a
80+
previous connection. (Without this, the choice is based on whether
81+
the database name looks like a conninfo string, as before.) This
82+
allows secure handling of database names containing special
83+
characters in <application>pg_dumpall</> scripts.
84+
</para>
85+
86+
<para>
87+
<application>pg_dumpall</> now refuses to deal with database and role
88+
names containing carriage returns or newlines, as it seems impractical
89+
to quote those characters safely on Windows. In future we may reject
90+
such names on the server side, but that step has not been taken yet.
91+
</para>
92+
93+
<para>
94+
These are considered security fixes because crafted object names
95+
containing special characters could have been used to execute
96+
commands with superuser privileges the next time a superuser
97+
executes <application>pg_dumpall</> or other routine maintenance
98+
operations. (CVE-2016-5424)
99+
</para>
100+
</listitem>
101+
36102
<listitem>
37103
<para>
38104
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -77,6 +143,20 @@
77143
</para>
78144
</listitem>
79145

146+
<listitem>
147+
<para>
148+
Fix several one-byte buffer over-reads in <function>to_number()</>
149+
(Peter Eisentraut)
150+
</para>
151+
152+
<para>
153+
In several cases the <function>to_number()</> function would read one
154+
more character than it should from the input string. There is a
155+
small chance of a crash, if the input happens to be adjacent to the
156+
end of memory.
157+
</para>
158+
</listitem>
159+
80160
<listitem>
81161
<para>
82162
Do not run the planner on the query contained in <literal>CREATE

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp