Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc89d2d0

Browse files
committed
Last-minute updates for release notes.
Security:CVE-2017-7484,CVE-2017-7485,CVE-2017-7486
1 parent9a591c1 commitc89d2d0

File tree

5 files changed

+727
-8
lines changed

5 files changed

+727
-8
lines changed

‎doc/src/sgml/release-9.2.sgml

Lines changed: 124 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,12 @@
2929
</para>
3030

3131
<para>
32-
However, if you are upgrading from a version earlier than 9.2.20,
32+
However, if you use foreign data servers that make use of user
33+
passwords for authentication, see the first changelog entry below.
34+
</para>
35+
36+
<para>
37+
Also, if you are upgrading from a version earlier than 9.2.20,
3338
see <xref linkend="release-9-2-20">.
3439
</para>
3540

@@ -40,6 +45,124 @@
4045

4146
<itemizedlist>
4247

48+
<listitem>
49+
<para>
50+
Restrict visibility
51+
of <structname>pg_user_mappings</>.<structfield>umoptions</>, to
52+
protect passwords stored as user mapping options
53+
(Michael Paquier, Feike Steenbergen)
54+
</para>
55+
56+
<para>
57+
The previous coding allowed the owner of a foreign server object,
58+
or anyone he has granted server <literal>USAGE</> permission to,
59+
to see the options for all user mappings associated with that server.
60+
This might well include passwords for other users.
61+
Adjust the view definition to match the behavior of
62+
<structname>information_schema.user_mapping_options</>, namely that
63+
these options are visible to the user being mapped, or if the mapping
64+
is for <literal>PUBLIC</literal> and the current user is the server
65+
owner, or if the current user is a superuser.
66+
(CVE-2017-7486)
67+
</para>
68+
69+
<para>
70+
By itself, this patch will only fix the behavior in newly initdb'd
71+
databases. If you wish to apply this change in an existing database,
72+
you will need to do the following:
73+
</para>
74+
75+
<procedure>
76+
<step>
77+
<para>
78+
Restart the postmaster after adding <literal>allow_system_table_mods
79+
= true</> to <filename>postgresql.conf</>. (In versions
80+
supporting <command>ALTER SYSTEM</>, you can use that to make the
81+
configuration change, but you'll still need a restart.)
82+
</para>
83+
</step>
84+
85+
<step>
86+
<para>
87+
In <emphasis>each</> database of the cluster,
88+
run the following commands as superuser:
89+
<programlisting>
90+
SET search_path = pg_catalog;
91+
CREATE OR REPLACE VIEW pg_user_mappings AS
92+
SELECT
93+
U.oid AS umid,
94+
S.oid AS srvid,
95+
S.srvname AS srvname,
96+
U.umuser AS umuser,
97+
CASE WHEN U.umuser = 0 THEN
98+
'public'
99+
ELSE
100+
A.rolname
101+
END AS usename,
102+
CASE WHEN (U.umuser &lt;&gt; 0 AND A.rolname = current_user)
103+
OR (U.umuser = 0 AND pg_has_role(S.srvowner, 'USAGE'))
104+
OR (SELECT rolsuper FROM pg_authid WHERE rolname = current_user)
105+
THEN U.umoptions
106+
ELSE NULL END AS umoptions
107+
FROM pg_user_mapping U
108+
LEFT JOIN pg_authid A ON (A.oid = U.umuser) JOIN
109+
pg_foreign_server S ON (U.umserver = S.oid);
110+
</programlisting>
111+
</para>
112+
</step>
113+
114+
<step>
115+
<para>
116+
Do not forget to include the <literal>template0</>
117+
and <literal>template1</> databases, or the vulnerability will still
118+
exist in databases you create later. To fix <literal>template0</>,
119+
you'll need to temporarily make it accept connections.
120+
In <productname>PostgreSQL</> 9.5 and later, you can use
121+
<programlisting>
122+
ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;
123+
</programlisting>
124+
and then after fixing <literal>template0</>, undo that with
125+
<programlisting>
126+
ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;
127+
</programlisting>
128+
In prior versions, instead use
129+
<programlisting>
130+
UPDATE pg_database SET datallowconn = true WHERE datname = 'template0';
131+
UPDATE pg_database SET datallowconn = false WHERE datname = 'template0';
132+
</programlisting>
133+
</para>
134+
</step>
135+
136+
<step>
137+
<para>
138+
Finally, remove the <literal>allow_system_table_mods</> configuration
139+
setting, and again restart the postmaster.
140+
</para>
141+
</step>
142+
</procedure>
143+
</listitem>
144+
145+
<listitem>
146+
<para>
147+
Prevent exposure of statistical information via leaky operators
148+
(Peter Eisentraut)
149+
</para>
150+
151+
<para>
152+
Some selectivity estimation functions in the planner will apply
153+
user-defined operators to values obtained
154+
from <structname>pg_statistic</>, such as most common values and
155+
histogram entries. This occurs before table permissions are checked,
156+
so a nefarious user could exploit the behavior to obtain these values
157+
for table columns he does not have permission to read. To fix,
158+
fall back to a default estimate if the operator's implementation
159+
function is not certified leak-proof and the calling user does not have
160+
permission to read the table column whose statistics are needed.
161+
At least one of these criteria is satisfied in most cases in practice.
162+
(CVE-2017-7484)
163+
</para>
164+
</listitem>
165+
43166
<listitem>
44167
<para>
45168
Fix possible corruption of <quote>init forks</> of unlogged indexes

‎doc/src/sgml/release-9.3.sgml

Lines changed: 142 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,12 @@
2323
</para>
2424

2525
<para>
26-
However, if you are upgrading from a version earlier than 9.3.16,
26+
However, if you use foreign data servers that make use of user
27+
passwords for authentication, see the first changelog entry below.
28+
</para>
29+
30+
<para>
31+
Also, if you are upgrading from a version earlier than 9.3.16,
2732
see <xref linkend="release-9-3-16">.
2833
</para>
2934

@@ -34,6 +39,142 @@
3439

3540
<itemizedlist>
3641

42+
<listitem>
43+
<para>
44+
Restrict visibility
45+
of <structname>pg_user_mappings</>.<structfield>umoptions</>, to
46+
protect passwords stored as user mapping options
47+
(Michael Paquier, Feike Steenbergen)
48+
</para>
49+
50+
<para>
51+
The previous coding allowed the owner of a foreign server object,
52+
or anyone he has granted server <literal>USAGE</> permission to,
53+
to see the options for all user mappings associated with that server.
54+
This might well include passwords for other users.
55+
Adjust the view definition to match the behavior of
56+
<structname>information_schema.user_mapping_options</>, namely that
57+
these options are visible to the user being mapped, or if the mapping
58+
is for <literal>PUBLIC</literal> and the current user is the server
59+
owner, or if the current user is a superuser.
60+
(CVE-2017-7486)
61+
</para>
62+
63+
<para>
64+
By itself, this patch will only fix the behavior in newly initdb'd
65+
databases. If you wish to apply this change in an existing database,
66+
you will need to do the following:
67+
</para>
68+
69+
<procedure>
70+
<step>
71+
<para>
72+
Restart the postmaster after adding <literal>allow_system_table_mods
73+
= true</> to <filename>postgresql.conf</>. (In versions
74+
supporting <command>ALTER SYSTEM</>, you can use that to make the
75+
configuration change, but you'll still need a restart.)
76+
</para>
77+
</step>
78+
79+
<step>
80+
<para>
81+
In <emphasis>each</> database of the cluster,
82+
run the following commands as superuser:
83+
<programlisting>
84+
SET search_path = pg_catalog;
85+
CREATE OR REPLACE VIEW pg_user_mappings AS
86+
SELECT
87+
U.oid AS umid,
88+
S.oid AS srvid,
89+
S.srvname AS srvname,
90+
U.umuser AS umuser,
91+
CASE WHEN U.umuser = 0 THEN
92+
'public'
93+
ELSE
94+
A.rolname
95+
END AS usename,
96+
CASE WHEN (U.umuser &lt;&gt; 0 AND A.rolname = current_user)
97+
OR (U.umuser = 0 AND pg_has_role(S.srvowner, 'USAGE'))
98+
OR (SELECT rolsuper FROM pg_authid WHERE rolname = current_user)
99+
THEN U.umoptions
100+
ELSE NULL END AS umoptions
101+
FROM pg_user_mapping U
102+
LEFT JOIN pg_authid A ON (A.oid = U.umuser) JOIN
103+
pg_foreign_server S ON (U.umserver = S.oid);
104+
</programlisting>
105+
</para>
106+
</step>
107+
108+
<step>
109+
<para>
110+
Do not forget to include the <literal>template0</>
111+
and <literal>template1</> databases, or the vulnerability will still
112+
exist in databases you create later. To fix <literal>template0</>,
113+
you'll need to temporarily make it accept connections.
114+
In <productname>PostgreSQL</> 9.5 and later, you can use
115+
<programlisting>
116+
ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;
117+
</programlisting>
118+
and then after fixing <literal>template0</>, undo that with
119+
<programlisting>
120+
ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;
121+
</programlisting>
122+
In prior versions, instead use
123+
<programlisting>
124+
UPDATE pg_database SET datallowconn = true WHERE datname = 'template0';
125+
UPDATE pg_database SET datallowconn = false WHERE datname = 'template0';
126+
</programlisting>
127+
</para>
128+
</step>
129+
130+
<step>
131+
<para>
132+
Finally, remove the <literal>allow_system_table_mods</> configuration
133+
setting, and again restart the postmaster.
134+
</para>
135+
</step>
136+
</procedure>
137+
</listitem>
138+
139+
<listitem>
140+
<para>
141+
Prevent exposure of statistical information via leaky operators
142+
(Peter Eisentraut)
143+
</para>
144+
145+
<para>
146+
Some selectivity estimation functions in the planner will apply
147+
user-defined operators to values obtained
148+
from <structname>pg_statistic</>, such as most common values and
149+
histogram entries. This occurs before table permissions are checked,
150+
so a nefarious user could exploit the behavior to obtain these values
151+
for table columns he does not have permission to read. To fix,
152+
fall back to a default estimate if the operator's implementation
153+
function is not certified leak-proof and the calling user does not have
154+
permission to read the table column whose statistics are needed.
155+
At least one of these criteria is satisfied in most cases in practice.
156+
(CVE-2017-7484)
157+
</para>
158+
</listitem>
159+
160+
<listitem>
161+
<para>
162+
Restore <application>libpq</>'s recognition of
163+
the <envar>PGREQUIRESSL</> environment variable (Daniel Gustafsson)
164+
</para>
165+
166+
<para>
167+
Processing of this environment variable was unintentionally dropped
168+
in <productname>PostgreSQL</> 9.3, but its documentation remained.
169+
This creates a security hazard, since users might be relying on the
170+
environment variable to force SSL-encrypted connections, but that
171+
would no longer be guaranteed. Restore handling of the variable,
172+
but give it lower priority than <envar>PGSSLMODE</>, to avoid
173+
breaking configurations that work correctly with post-9.3 code.
174+
(CVE-2017-7485)
175+
</para>
176+
</listitem>
177+
37178
<listitem>
38179
<para>
39180
Fix possible corruption of <quote>init forks</> of unlogged indexes

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp