mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-13 23:09:36 +02:00
Last-minute updates for release notes.
Security: CVE-2018-1115
This commit is contained in:
parent
53b79ab4fe
commit
1950d5b7a2
@ -23,9 +23,14 @@
|
||||
</para>
|
||||
|
||||
<para>
|
||||
However, if the function marking mistakes mentioned in the first two
|
||||
changelog entries below affect you, you will want to take steps to
|
||||
correct your database catalogs.
|
||||
However, if you use the <filename>adminpack</filename> extension,
|
||||
you should update it as per the first changelog entry below.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Also, if the function marking mistakes mentioned in the second and
|
||||
third changelog entries below affect you, you will want to take steps
|
||||
to correct your database catalogs.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
@ -39,6 +44,33 @@
|
||||
|
||||
<itemizedlist>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
Remove public execute privilege
|
||||
from <filename>contrib/adminpack</filename>'s
|
||||
<function>pg_logfile_rotate()</function> function (Stephen Frost)
|
||||
</para>
|
||||
|
||||
<para>
|
||||
<function>pg_logfile_rotate()</function> is a deprecated wrapper
|
||||
for the core function <function>pg_rotate_logfile()</function>.
|
||||
When that function was changed to rely on SQL privileges for access
|
||||
control rather than a hard-coded superuser
|
||||
check, <function>pg_logfile_rotate()</function> should have been
|
||||
updated as well, but the need for this was missed. Hence,
|
||||
if <filename>adminpack</filename> is installed, any user could
|
||||
request a logfile rotation, creating a minor security issue.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
After installing this update, administrators should
|
||||
update <filename>adminpack</filename> by performing
|
||||
<literal>ALTER EXTENSION adminpack UPDATE</literal> in each
|
||||
database in which <filename>adminpack</filename> is installed.
|
||||
(CVE-2018-1115)
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
Fix incorrect volatility markings on a few built-in functions
|
||||
|
Loading…
Reference in New Issue
Block a user