Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit749839c

Browse files
committed
Last-minute updates for release notes.
Security:CVE-2018-10915,CVE-2018-10925
1 parentf6f735f commit749839c

File tree

5 files changed

+221
-53
lines changed

5 files changed

+221
-53
lines changed

‎doc/src/sgml/release-10.sgml‎

Lines changed: 67 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,73 @@
3535

3636
<listitem>
3737
<!--
38+
Author: Tom Lane <tgl@sss.pgh.pa.us>
39+
Branch: master [d1c6a14ba] 2018-08-06 10:53:35 -0400
40+
Branch: REL_11_STABLE [f6f735f78] 2018-08-06 10:53:35 -0400
41+
Branch: REL_10_STABLE [ab5400469] 2018-08-06 10:53:35 -0400
42+
Branch: REL9_6_STABLE [a8094d0fe] 2018-08-06 10:53:35 -0400
43+
Branch: REL9_5_STABLE [7aabfd1d8] 2018-08-06 10:53:35 -0400
44+
Branch: REL9_4_STABLE [6de9766b8] 2018-08-06 10:53:35 -0400
45+
Branch: REL9_3_STABLE [243de06be] 2018-08-06 10:53:35 -0400
46+
-->
47+
<para>
48+
Fix failure to reset <application>libpq</application>'s state fully
49+
between connection attempts (Tom Lane)
50+
</para>
51+
52+
<para>
53+
An unprivileged user of <filename>dblink</filename>
54+
or <filename>postgres_fdw</filename> could bypass the checks intended
55+
to prevent use of server-side credentials, such as
56+
a <filename>~/.pgpass</filename> file owned by the operating-system
57+
user running the server. Servers allowing peer authentication on
58+
local connections are particularly vulnerable. Other attacks such
59+
as SQL injection into a <filename>postgres_fdw</filename> session
60+
are also possible.
61+
Attacking <filename>postgres_fdw</filename> in this way requires the
62+
ability to create a foreign server object with selected connection
63+
parameters, but any user with access to <filename>dblink</filename>
64+
could exploit the problem.
65+
In general, an attacker with the ability to select the connection
66+
parameters for a <application>libpq</application>-using application
67+
could cause mischief, though other plausible attack scenarios are
68+
harder to think of.
69+
Our thanks to Andrew Krasichkov for reporting this issue.
70+
(CVE-2018-10915)
71+
</para>
72+
</listitem>
73+
74+
<listitem>
75+
<!--
76+
Author: Tom Lane <tgl@sss.pgh.pa.us>
77+
Branch: master [b8a1247a3] 2018-08-04 19:38:58 -0400
78+
Branch: REL_11_STABLE [e7154b6ac] 2018-08-04 19:38:58 -0400
79+
Branch: REL_10_STABLE [f6a124d01] 2018-08-04 19:38:58 -0400
80+
Branch: REL9_6_STABLE [b484bffe7] 2018-08-04 19:38:58 -0400
81+
Branch: REL9_5_STABLE [5ad143cda] 2018-08-04 19:38:59 -0400
82+
-->
83+
<para>
84+
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
85+
that isn't just <literal>SELECT * FROM ...</literal>
86+
(Dean Rasheed, Amit Langote)
87+
</para>
88+
89+
<para>
90+
Erroneous expansion of an updatable view could lead to crashes
91+
or <quote>attribute ... has the wrong type</quote> errors, if the
92+
view's <literal>SELECT</literal> list doesn't match one-to-one with
93+
the underlying table's columns.
94+
Furthermore, this bug could be leveraged to allow updates of columns
95+
that an attacking user lacks <literal>UPDATE</literal> privilege for,
96+
if that user has <literal>INSERT</literal> and <literal>UPDATE</literal>
97+
privileges for some other column(s) of the table.
98+
Any user could also use it for disclosure of server memory.
99+
(CVE-2018-10925)
100+
</para>
101+
</listitem>
102+
103+
<listitem>
104+
<!--
38105
Author: Andres Freund <andres@anarazel.de>
39106
Branch: master Release: REL_11_BR [a54e1f158] 2018-06-12 11:13:21 -0700
40107
Branch: REL_10_STABLE [2ce64caaf] 2018-06-12 11:13:21 -0700
@@ -260,29 +327,6 @@ Branch: REL_10_STABLE [4beb25c63] 2018-07-16 17:55:13 -0400
260327

261328
<listitem>
262329
<!--
263-
Author: Tom Lane <tgl@sss.pgh.pa.us>
264-
Branch: master [b8a1247a3] 2018-08-04 19:38:58 -0400
265-
Branch: REL_11_STABLE [e7154b6ac] 2018-08-04 19:38:58 -0400
266-
Branch: REL_10_STABLE [f6a124d01] 2018-08-04 19:38:58 -0400
267-
Branch: REL9_6_STABLE [b484bffe7] 2018-08-04 19:38:58 -0400
268-
Branch: REL9_5_STABLE [5ad143cda] 2018-08-04 19:38:59 -0400
269-
-->
270-
<para>
271-
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
272-
that isn't just <literal>SELECT * FROM ...</literal>
273-
(Dean Rasheed, Amit Langote)
274-
</para>
275-
276-
<para>
277-
Erroneous expansion of an updatable view could lead to crashes
278-
or <quote>attribute ... has the wrong type</quote> errors, if the
279-
view's <literal>SELECT</literal> list doesn't match one-to-one with
280-
the underlying table's columns.
281-
</para>
282-
</listitem>
283-
284-
<listitem>
285-
<!--
286330
Author: Peter Geoghegan <pg@bowt.ie>
287331
Branch: master [b3f919da0] 2018-08-03 15:11:31 -0700
288332
Branch: REL_11_STABLE [b9612e5cf] 2018-08-03 14:45:02 -0700

‎doc/src/sgml/release-9.3.sgml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,34 @@
3939

4040
<itemizedlist>
4141

42+
<listitem>
43+
<para>
44+
Fix failure to reset <application>libpq</application>'s state fully
45+
between connection attempts (Tom Lane)
46+
</para>
47+
48+
<para>
49+
An unprivileged user of <filename>dblink</filename>
50+
or <filename>postgres_fdw</filename> could bypass the checks intended
51+
to prevent use of server-side credentials, such as
52+
a <filename>~/.pgpass</filename> file owned by the operating-system
53+
user running the server. Servers allowing peer authentication on
54+
local connections are particularly vulnerable. Other attacks such
55+
as SQL injection into a <filename>postgres_fdw</filename> session
56+
are also possible.
57+
Attacking <filename>postgres_fdw</filename> in this way requires the
58+
ability to create a foreign server object with selected connection
59+
parameters, but any user with access to <filename>dblink</filename>
60+
could exploit the problem.
61+
In general, an attacker with the ability to select the connection
62+
parameters for a <application>libpq</application>-using application
63+
could cause mischief, though other plausible attack scenarios are
64+
harder to think of.
65+
Our thanks to Andrew Krasichkov for reporting this issue.
66+
(CVE-2018-10915)
67+
</para>
68+
</listitem>
69+
4270
<listitem>
4371
<para>
4472
Ensure that updates to the <structfield>relfrozenxid</structfield>

‎doc/src/sgml/release-9.4.sgml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,34 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix failure to reset <application>libpq</application>'s state fully
39+
between connection attempts (Tom Lane)
40+
</para>
41+
42+
<para>
43+
An unprivileged user of <filename>dblink</filename>
44+
or <filename>postgres_fdw</filename> could bypass the checks intended
45+
to prevent use of server-side credentials, such as
46+
a <filename>~/.pgpass</filename> file owned by the operating-system
47+
user running the server. Servers allowing peer authentication on
48+
local connections are particularly vulnerable. Other attacks such
49+
as SQL injection into a <filename>postgres_fdw</filename> session
50+
are also possible.
51+
Attacking <filename>postgres_fdw</filename> in this way requires the
52+
ability to create a foreign server object with selected connection
53+
parameters, but any user with access to <filename>dblink</filename>
54+
could exploit the problem.
55+
In general, an attacker with the ability to select the connection
56+
parameters for a <application>libpq</application>-using application
57+
could cause mischief, though other plausible attack scenarios are
58+
harder to think of.
59+
Our thanks to Andrew Krasichkov for reporting this issue.
60+
(CVE-2018-10915)
61+
</para>
62+
</listitem>
63+
3664
<listitem>
3765
<para>
3866
Ensure that updates to the <structfield>relfrozenxid</structfield>

‎doc/src/sgml/release-9.5.sgml‎

Lines changed: 49 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,55 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix failure to reset <application>libpq</application>'s state fully
39+
between connection attempts (Tom Lane)
40+
</para>
41+
42+
<para>
43+
An unprivileged user of <filename>dblink</filename>
44+
or <filename>postgres_fdw</filename> could bypass the checks intended
45+
to prevent use of server-side credentials, such as
46+
a <filename>~/.pgpass</filename> file owned by the operating-system
47+
user running the server. Servers allowing peer authentication on
48+
local connections are particularly vulnerable. Other attacks such
49+
as SQL injection into a <filename>postgres_fdw</filename> session
50+
are also possible.
51+
Attacking <filename>postgres_fdw</filename> in this way requires the
52+
ability to create a foreign server object with selected connection
53+
parameters, but any user with access to <filename>dblink</filename>
54+
could exploit the problem.
55+
In general, an attacker with the ability to select the connection
56+
parameters for a <application>libpq</application>-using application
57+
could cause mischief, though other plausible attack scenarios are
58+
harder to think of.
59+
Our thanks to Andrew Krasichkov for reporting this issue.
60+
(CVE-2018-10915)
61+
</para>
62+
</listitem>
63+
64+
<listitem>
65+
<para>
66+
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
67+
that isn't just <literal>SELECT * FROM ...</literal>
68+
(Dean Rasheed, Amit Langote)
69+
</para>
70+
71+
<para>
72+
Erroneous expansion of an updatable view could lead to crashes
73+
or <quote>attribute ... has the wrong type</quote> errors, if the
74+
view's <literal>SELECT</literal> list doesn't match one-to-one with
75+
the underlying table's columns.
76+
Furthermore, this bug could be leveraged to allow updates of columns
77+
that an attacking user lacks <literal>UPDATE</literal> privilege for,
78+
if that user has <literal>INSERT</literal> and <literal>UPDATE</literal>
79+
privileges for some other column(s) of the table.
80+
Any user could also use it for disclosure of server memory.
81+
(CVE-2018-10925)
82+
</para>
83+
</listitem>
84+
3685
<listitem>
3786
<para>
3887
Ensure that updates to the <structfield>relfrozenxid</structfield>
@@ -140,21 +189,6 @@
140189
</para>
141190
</listitem>
142191

143-
<listitem>
144-
<para>
145-
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
146-
that isn't just <literal>SELECT * FROM ...</literal>
147-
(Dean Rasheed, Amit Langote)
148-
</para>
149-
150-
<para>
151-
Erroneous expansion of an updatable view could lead to crashes
152-
or <quote>attribute ... has the wrong type</quote> errors, if the
153-
view's <literal>SELECT</literal> list doesn't match one-to-one with
154-
the underlying table's columns.
155-
</para>
156-
</listitem>
157-
158192
<listitem>
159193
<para>
160194
Ensure a table's cached index list is correctly rebuilt after an index

‎doc/src/sgml/release-9.6.sgml‎

Lines changed: 49 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,55 @@
3333

3434
<itemizedlist>
3535

36+
<listitem>
37+
<para>
38+
Fix failure to reset <application>libpq</application>'s state fully
39+
between connection attempts (Tom Lane)
40+
</para>
41+
42+
<para>
43+
An unprivileged user of <filename>dblink</filename>
44+
or <filename>postgres_fdw</filename> could bypass the checks intended
45+
to prevent use of server-side credentials, such as
46+
a <filename>~/.pgpass</filename> file owned by the operating-system
47+
user running the server. Servers allowing peer authentication on
48+
local connections are particularly vulnerable. Other attacks such
49+
as SQL injection into a <filename>postgres_fdw</filename> session
50+
are also possible.
51+
Attacking <filename>postgres_fdw</filename> in this way requires the
52+
ability to create a foreign server object with selected connection
53+
parameters, but any user with access to <filename>dblink</filename>
54+
could exploit the problem.
55+
In general, an attacker with the ability to select the connection
56+
parameters for a <application>libpq</application>-using application
57+
could cause mischief, though other plausible attack scenarios are
58+
harder to think of.
59+
Our thanks to Andrew Krasichkov for reporting this issue.
60+
(CVE-2018-10915)
61+
</para>
62+
</listitem>
63+
64+
<listitem>
65+
<para>
66+
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
67+
that isn't just <literal>SELECT * FROM ...</literal>
68+
(Dean Rasheed, Amit Langote)
69+
</para>
70+
71+
<para>
72+
Erroneous expansion of an updatable view could lead to crashes
73+
or <quote>attribute ... has the wrong type</quote> errors, if the
74+
view's <literal>SELECT</literal> list doesn't match one-to-one with
75+
the underlying table's columns.
76+
Furthermore, this bug could be leveraged to allow updates of columns
77+
that an attacking user lacks <literal>UPDATE</literal> privilege for,
78+
if that user has <literal>INSERT</literal> and <literal>UPDATE</literal>
79+
privileges for some other column(s) of the table.
80+
Any user could also use it for disclosure of server memory.
81+
(CVE-2018-10925)
82+
</para>
83+
</listitem>
84+
3685
<listitem>
3786
<para>
3887
Ensure that updates to the <structfield>relfrozenxid</structfield>
@@ -140,21 +189,6 @@
140189
</para>
141190
</listitem>
142191

143-
<listitem>
144-
<para>
145-
Fix <literal>INSERT ... ON CONFLICT UPDATE</literal> through a view
146-
that isn't just <literal>SELECT * FROM ...</literal>
147-
(Dean Rasheed, Amit Langote)
148-
</para>
149-
150-
<para>
151-
Erroneous expansion of an updatable view could lead to crashes
152-
or <quote>attribute ... has the wrong type</quote> errors, if the
153-
view's <literal>SELECT</literal> list doesn't match one-to-one with
154-
the underlying table's columns.
155-
</para>
156-
</listitem>
157-
158192
<listitem>
159193
<para>
160194
Ensure a table's cached index list is correctly rebuilt after an index

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp