mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-11-21 03:13:05 +08:00
Last-minute updates for release notes.
Security: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870
This commit is contained in:
Tom Lane
parent
c48008f599
commit
3dbb3dd2d6
@ -41,6 +41,119 @@
|
|||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<!--
|
<!--
|
||||||
|
Author: Tom Lane <tgl@sss.pgh.pa.us>
|
||||||
|
Branch: master [3b0776fde] 2023-11-06 10:38:00 -0500
|
||||||
|
Branch: REL_16_STABLE [d3d1e2509] 2023-11-06 10:38:00 -0500
|
||||||
|
Branch: REL_15_STABLE [4f4a422fb] 2023-11-06 10:38:00 -0500
|
||||||
|
Branch: REL_14_STABLE [9146d0d65] 2023-11-06 10:38:00 -0500
|
||||||
|
Branch: REL_13_STABLE [d3de70fdb] 2023-11-06 10:38:00 -0500
|
||||||
|
Branch: REL_12_STABLE [e911afd09] 2023-11-06 10:38:00 -0500
|
||||||
|
Branch: REL_11_STABLE [8c6633f4d] 2023-11-06 10:38:00 -0500
|
||||||
|
-->
|
||||||
|
<para>
|
||||||
|
Fix handling of unknown-type arguments
|
||||||
|
in <literal>DISTINCT</literal> <type>"any"</type> aggregate
|
||||||
|
functions (Tom Lane)
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
This error led to a <type>text</type>-type value being interpreted
|
||||||
|
as an <type>unknown</type>-type value (that is, a zero-terminated
|
||||||
|
string) at runtime. This could result in disclosure of server
|
||||||
|
memory following the <type>text</type> value.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
The <productname>PostgreSQL</productname> Project thanks Jingzhou Fu
|
||||||
|
for reporting this problem.
|
||||||
|
(CVE-2023-5868)
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<!--
|
||||||
|
Author: Tom Lane <tgl@sss.pgh.pa.us>
|
||||||
|
Branch: master [18b585155] 2023-11-06 10:56:43 -0500
|
||||||
|
Branch: REL_16_STABLE [e24daa94b] 2023-11-06 10:56:43 -0500
|
||||||
|
Branch: REL_15_STABLE [3bc6bc3ee] 2023-11-06 10:56:43 -0500
|
||||||
|
Branch: REL_14_STABLE [edc0a8d82] 2023-11-06 10:56:43 -0500
|
||||||
|
Branch: REL_13_STABLE [26c599beb] 2023-11-06 10:56:43 -0500
|
||||||
|
Branch: REL_12_STABLE [d267cea24] 2023-11-06 10:56:43 -0500
|
||||||
|
Branch: REL_11_STABLE [c48008f59] 2023-11-06 10:56:43 -0500
|
||||||
|
-->
|
||||||
|
<para>
|
||||||
|
Detect integer overflow while computing new array dimensions
|
||||||
|
(Tom Lane)
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
When assigning new elements to array subscripts that are outside the
|
||||||
|
current array bounds, an undetected integer overflow could occur in
|
||||||
|
edge cases. Memory stomps that are potentially exploitable for
|
||||||
|
arbitrary code execution are possible, and so is disclosure of
|
||||||
|
server memory.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
The <productname>PostgreSQL</productname> Project thanks Pedro
|
||||||
|
Gallegos for reporting this problem.
|
||||||
|
(CVE-2023-5869)
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<!--
|
||||||
|
Author: Noah Misch <noah@leadboat.com>
|
||||||
|
Branch: master [3a9b18b30] 2023-11-06 06:14:13 -0800
|
||||||
|
Branch: REL_16_STABLE [785412731] 2023-11-06 06:14:16 -0800
|
||||||
|
Branch: REL_15_STABLE [595c988c9] 2023-11-06 06:14:16 -0800
|
||||||
|
Branch: REL_14_STABLE [508acb901] 2023-11-06 06:14:17 -0800
|
||||||
|
Branch: REL_13_STABLE [28b609550] 2023-11-06 06:14:17 -0800
|
||||||
|
Branch: REL_12_STABLE [2893f2f40] 2023-11-06 06:14:17 -0800
|
||||||
|
Branch: REL_11_STABLE [e082734c8] 2023-11-06 06:14:18 -0800
|
||||||
|
Author: Noah Misch <noah@leadboat.com>
|
||||||
|
Branch: master [b72de09a1] 2023-11-06 06:14:13 -0800
|
||||||
|
Branch: REL_16_STABLE [2c3c5ec49] 2023-11-06 06:14:16 -0800
|
||||||
|
Branch: REL_15_STABLE [fbc371909] 2023-11-06 06:14:16 -0800
|
||||||
|
Branch: REL_14_STABLE [ecd5d240c] 2023-11-06 06:14:17 -0800
|
||||||
|
Branch: REL_13_STABLE [2c7a2a00a] 2023-11-06 06:14:17 -0800
|
||||||
|
Branch: REL_12_STABLE [7bbf4d037] 2023-11-06 06:14:17 -0800
|
||||||
|
Branch: REL_11_STABLE [a27be40c1] 2023-11-06 06:14:18 -0800
|
||||||
|
-->
|
||||||
|
<para>
|
||||||
|
Prevent the <literal>pg_signal_backend</literal> role from
|
||||||
|
signalling background workers and autovacuum processes
|
||||||
|
(Noah Misch, Jelte Fennema-Nio)
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
The documentation says that <literal>pg_signal_backend</literal>
|
||||||
|
cannot issue signals to superuser-owned processes. It was able to
|
||||||
|
signal these background processes, though, because they advertise a
|
||||||
|
role OID of zero. Treat that as indicating superuser ownership.
|
||||||
|
The security implications of cancelling one of these process types
|
||||||
|
are fairly small so far as the core code goes (we'll just start
|
||||||
|
another one), but extensions might add background workers that are
|
||||||
|
more vulnerable.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
Also ensure that the <varname>is_superuser</varname> parameter is
|
||||||
|
set correctly in such processes. No specific security consequences
|
||||||
|
are known for that oversight, but it might be significant for some
|
||||||
|
extensions.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
The <productname>PostgreSQL</productname> Project thanks
|
||||||
|
Hemanth Sandrana and Mahendrakar Srinivasarao
|
||||||
|
for reporting this problem.
|
||||||
|
(CVE-2023-5870)
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<!--
|
||||||
Author: David Rowley <drowley@postgresql.org>
|
Author: David Rowley <drowley@postgresql.org>
|
||||||
Branch: master [d9e46dfb7] 2023-10-13 01:12:31 +1300
|
Branch: master [d9e46dfb7] 2023-10-13 01:12:31 +1300
|
||||||
Branch: REL_16_STABLE [595db9e9c] 2023-10-13 01:13:07 +1300
|
Branch: REL_16_STABLE [595db9e9c] 2023-10-13 01:13:07 +1300
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user