From 3dbb3dd2d641af0da92e0a25b490b5bc38490e58 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 6 Nov 2023 13:26:33 -0500 Subject: [PATCH] Last-minute updates for release notes. Security: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870 --- doc/src/sgml/release-11.sgml | 113 +++++++++++++++++++++++++++++++++++ 1 file changed, 113 insertions(+) diff --git a/doc/src/sgml/release-11.sgml b/doc/src/sgml/release-11.sgml index 86c73bedc5..7d71c44fd2 100644 --- a/doc/src/sgml/release-11.sgml +++ b/doc/src/sgml/release-11.sgml @@ -41,6 +41,119 @@ + + Fix handling of unknown-type arguments + in DISTINCT "any" aggregate + functions (Tom Lane) + + + + This error led to a text-type value being interpreted + as an unknown-type value (that is, a zero-terminated + string) at runtime. This could result in disclosure of server + memory following the text value. + + + + The PostgreSQL Project thanks Jingzhou Fu + for reporting this problem. + (CVE-2023-5868) + + + + + + + Detect integer overflow while computing new array dimensions + (Tom Lane) + + + + When assigning new elements to array subscripts that are outside the + current array bounds, an undetected integer overflow could occur in + edge cases. Memory stomps that are potentially exploitable for + arbitrary code execution are possible, and so is disclosure of + server memory. + + + + The PostgreSQL Project thanks Pedro + Gallegos for reporting this problem. + (CVE-2023-5869) + + + + + + + Prevent the pg_signal_backend role from + signalling background workers and autovacuum processes + (Noah Misch, Jelte Fennema-Nio) + + + + The documentation says that pg_signal_backend + cannot issue signals to superuser-owned processes. It was able to + signal these background processes, though, because they advertise a + role OID of zero. Treat that as indicating superuser ownership. + The security implications of cancelling one of these process types + are fairly small so far as the core code goes (we'll just start + another one), but extensions might add background workers that are + more vulnerable. + + + + Also ensure that the is_superuser parameter is + set correctly in such processes. No specific security consequences + are known for that oversight, but it might be significant for some + extensions. + + + + The PostgreSQL Project thanks + Hemanth Sandrana and Mahendrakar Srinivasarao + for reporting this problem. + (CVE-2023-5870) + + + + +