Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit43957e8

Browse files
committed
Last-minute updates for release notes.
Security:CVE-2016-5423,CVE-2016-5424
1 parent43d7a0a commit43957e8

File tree

3 files changed

+240
-0
lines changed

3 files changed

+240
-0
lines changed

‎doc/src/sgml/release-9.1.sgml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,72 @@
4040

4141
<itemizedlist>
4242

43+
<listitem>
44+
<para>
45+
Fix possible mis-evaluation of
46+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
47+
Linnakangas, Michael Paquier, Tom Lane)
48+
</para>
49+
50+
<para>
51+
A <literal>CASE</> expression appearing within the test value
52+
subexpression of another <literal>CASE</> could become confused about
53+
whether its own test value was null or not. Also, inlining of a SQL
54+
function implementing the equality operator used by
55+
a <literal>CASE</> expression could result in passing the wrong test
56+
value to functions called within a <literal>CASE</> expression in the
57+
SQL function's body. If the test values were of different data
58+
types, a crash might result; moreover such situations could be abused
59+
to allow disclosure of portions of server memory. (CVE-2016-5423)
60+
</para>
61+
</listitem>
62+
63+
<listitem>
64+
<para>
65+
Fix client programs' handling of special characters in database and
66+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
67+
</para>
68+
69+
<para>
70+
Numerous places in <application>vacuumdb</> and other client programs
71+
could become confused by database and role names containing double
72+
quotes or backslashes. Tighten up quoting rules to make that safe.
73+
Also, ensure that when a conninfo string is used as a database name
74+
parameter to these programs, it is correctly treated as such throughout.
75+
</para>
76+
77+
<para>
78+
Fix handling of paired double quotes
79+
in <application>psql</>'s <command>\connect</>
80+
and <command>\password</> commands to match the documentation.
81+
</para>
82+
83+
<para>
84+
Introduce a new <option>-reuse-previous</> option
85+
in <application>psql</>'s <command>\connect</> command to allow
86+
explicit control of whether to re-use connection parameters from a
87+
previous connection. (Without this, the choice is based on whether
88+
the database name looks like a conninfo string, as before.) This
89+
allows secure handling of database names containing special
90+
characters in <application>pg_dumpall</> scripts.
91+
</para>
92+
93+
<para>
94+
<application>pg_dumpall</> now refuses to deal with database and role
95+
names containing carriage returns or newlines, as it seems impractical
96+
to quote those characters safely on Windows. In future we may reject
97+
such names on the server side, but that step has not been taken yet.
98+
</para>
99+
100+
<para>
101+
These are considered security fixes because crafted object names
102+
containing special characters could have been used to execute
103+
commands with superuser privileges the next time a superuser
104+
executes <application>pg_dumpall</> or other routine maintenance
105+
operations. (CVE-2016-5424)
106+
</para>
107+
</listitem>
108+
43109
<listitem>
44110
<para>
45111
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -77,6 +143,20 @@
77143
</para>
78144
</listitem>
79145

146+
<listitem>
147+
<para>
148+
Fix several one-byte buffer over-reads in <function>to_number()</>
149+
(Peter Eisentraut)
150+
</para>
151+
152+
<para>
153+
In several cases the <function>to_number()</> function would read one
154+
more character than it should from the input string. There is a
155+
small chance of a crash, if the input happens to be adjacent to the
156+
end of memory.
157+
</para>
158+
</listitem>
159+
80160
<listitem>
81161
<para>
82162
Avoid unsafe intermediate state during expensive paths

‎doc/src/sgml/release-9.2.sgml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,72 @@
3434

3535
<itemizedlist>
3636

37+
<listitem>
38+
<para>
39+
Fix possible mis-evaluation of
40+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
41+
Linnakangas, Michael Paquier, Tom Lane)
42+
</para>
43+
44+
<para>
45+
A <literal>CASE</> expression appearing within the test value
46+
subexpression of another <literal>CASE</> could become confused about
47+
whether its own test value was null or not. Also, inlining of a SQL
48+
function implementing the equality operator used by
49+
a <literal>CASE</> expression could result in passing the wrong test
50+
value to functions called within a <literal>CASE</> expression in the
51+
SQL function's body. If the test values were of different data
52+
types, a crash might result; moreover such situations could be abused
53+
to allow disclosure of portions of server memory. (CVE-2016-5423)
54+
</para>
55+
</listitem>
56+
57+
<listitem>
58+
<para>
59+
Fix client programs' handling of special characters in database and
60+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
61+
</para>
62+
63+
<para>
64+
Numerous places in <application>vacuumdb</> and other client programs
65+
could become confused by database and role names containing double
66+
quotes or backslashes. Tighten up quoting rules to make that safe.
67+
Also, ensure that when a conninfo string is used as a database name
68+
parameter to these programs, it is correctly treated as such throughout.
69+
</para>
70+
71+
<para>
72+
Fix handling of paired double quotes
73+
in <application>psql</>'s <command>\connect</>
74+
and <command>\password</> commands to match the documentation.
75+
</para>
76+
77+
<para>
78+
Introduce a new <option>-reuse-previous</> option
79+
in <application>psql</>'s <command>\connect</> command to allow
80+
explicit control of whether to re-use connection parameters from a
81+
previous connection. (Without this, the choice is based on whether
82+
the database name looks like a conninfo string, as before.) This
83+
allows secure handling of database names containing special
84+
characters in <application>pg_dumpall</> scripts.
85+
</para>
86+
87+
<para>
88+
<application>pg_dumpall</> now refuses to deal with database and role
89+
names containing carriage returns or newlines, as it seems impractical
90+
to quote those characters safely on Windows. In future we may reject
91+
such names on the server side, but that step has not been taken yet.
92+
</para>
93+
94+
<para>
95+
These are considered security fixes because crafted object names
96+
containing special characters could have been used to execute
97+
commands with superuser privileges the next time a superuser
98+
executes <application>pg_dumpall</> or other routine maintenance
99+
operations. (CVE-2016-5424)
100+
</para>
101+
</listitem>
102+
37103
<listitem>
38104
<para>
39105
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -71,6 +137,20 @@
71137
</para>
72138
</listitem>
73139

140+
<listitem>
141+
<para>
142+
Fix several one-byte buffer over-reads in <function>to_number()</>
143+
(Peter Eisentraut)
144+
</para>
145+
146+
<para>
147+
In several cases the <function>to_number()</> function would read one
148+
more character than it should from the input string. There is a
149+
small chance of a crash, if the input happens to be adjacent to the
150+
end of memory.
151+
</para>
152+
</listitem>
153+
74154
<listitem>
75155
<para>
76156
Avoid unsafe intermediate state during expensive paths

‎doc/src/sgml/release-9.3.sgml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,72 @@
3434

3535
<itemizedlist>
3636

37+
<listitem>
38+
<para>
39+
Fix possible mis-evaluation of
40+
nested <literal>CASE</>-<literal>WHEN</> expressions (Heikki
41+
Linnakangas, Michael Paquier, Tom Lane)
42+
</para>
43+
44+
<para>
45+
A <literal>CASE</> expression appearing within the test value
46+
subexpression of another <literal>CASE</> could become confused about
47+
whether its own test value was null or not. Also, inlining of a SQL
48+
function implementing the equality operator used by
49+
a <literal>CASE</> expression could result in passing the wrong test
50+
value to functions called within a <literal>CASE</> expression in the
51+
SQL function's body. If the test values were of different data
52+
types, a crash might result; moreover such situations could be abused
53+
to allow disclosure of portions of server memory. (CVE-2016-5423)
54+
</para>
55+
</listitem>
56+
57+
<listitem>
58+
<para>
59+
Fix client programs' handling of special characters in database and
60+
role names (Noah Misch, Nathan Bossart, Michael Paquier)
61+
</para>
62+
63+
<para>
64+
Numerous places in <application>vacuumdb</> and other client programs
65+
could become confused by database and role names containing double
66+
quotes or backslashes. Tighten up quoting rules to make that safe.
67+
Also, ensure that when a conninfo string is used as a database name
68+
parameter to these programs, it is correctly treated as such throughout.
69+
</para>
70+
71+
<para>
72+
Fix handling of paired double quotes
73+
in <application>psql</>'s <command>\connect</>
74+
and <command>\password</> commands to match the documentation.
75+
</para>
76+
77+
<para>
78+
Introduce a new <option>-reuse-previous</> option
79+
in <application>psql</>'s <command>\connect</> command to allow
80+
explicit control of whether to re-use connection parameters from a
81+
previous connection. (Without this, the choice is based on whether
82+
the database name looks like a conninfo string, as before.) This
83+
allows secure handling of database names containing special
84+
characters in <application>pg_dumpall</> scripts.
85+
</para>
86+
87+
<para>
88+
<application>pg_dumpall</> now refuses to deal with database and role
89+
names containing carriage returns or newlines, as it seems impractical
90+
to quote those characters safely on Windows. In future we may reject
91+
such names on the server side, but that step has not been taken yet.
92+
</para>
93+
94+
<para>
95+
These are considered security fixes because crafted object names
96+
containing special characters could have been used to execute
97+
commands with superuser privileges the next time a superuser
98+
executes <application>pg_dumpall</> or other routine maintenance
99+
operations. (CVE-2016-5424)
100+
</para>
101+
</listitem>
102+
37103
<listitem>
38104
<para>
39105
Fix corner-case misbehaviors for <literal>IS NULL</>/<literal>IS NOT
@@ -78,6 +144,20 @@
78144
</para>
79145
</listitem>
80146

147+
<listitem>
148+
<para>
149+
Fix several one-byte buffer over-reads in <function>to_number()</>
150+
(Peter Eisentraut)
151+
</para>
152+
153+
<para>
154+
In several cases the <function>to_number()</> function would read one
155+
more character than it should from the input string. There is a
156+
small chance of a crash, if the input happens to be adjacent to the
157+
end of memory.
158+
</para>
159+
</listitem>
160+
81161
<listitem>
82162
<para>
83163
Do not run the planner on the query contained in <literal>CREATE

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp