diff --git a/doc/src/sgml/release-9.3.sgml b/doc/src/sgml/release-9.3.sgml index a2078eac9e..b0b46b4b39 100644 --- a/doc/src/sgml/release-9.3.sgml +++ b/doc/src/sgml/release-9.3.sgml @@ -39,6 +39,34 @@ + + + Fix failure to reset libpq's state fully + between connection attempts (Tom Lane) + + + + An unprivileged user of dblink + or postgres_fdw could bypass the checks intended + to prevent use of server-side credentials, such as + a ~/.pgpass file owned by the operating-system + user running the server. Servers allowing peer authentication on + local connections are particularly vulnerable. Other attacks such + as SQL injection into a postgres_fdw session + are also possible. + Attacking postgres_fdw in this way requires the + ability to create a foreign server object with selected connection + parameters, but any user with access to dblink + could exploit the problem. + In general, an attacker with the ability to select the connection + parameters for a libpq-using application + could cause mischief, though other plausible attack scenarios are + harder to think of. + Our thanks to Andrew Krasichkov for reporting this issue. + (CVE-2018-10915) + + + Ensure that updates to the relfrozenxid diff --git a/doc/src/sgml/release-9.4.sgml b/doc/src/sgml/release-9.4.sgml index 6568a934d4..71b760a91a 100644 --- a/doc/src/sgml/release-9.4.sgml +++ b/doc/src/sgml/release-9.4.sgml @@ -33,6 +33,34 @@ + + + Fix failure to reset libpq's state fully + between connection attempts (Tom Lane) + + + + An unprivileged user of dblink + or postgres_fdw could bypass the checks intended + to prevent use of server-side credentials, such as + a ~/.pgpass file owned by the operating-system + user running the server. Servers allowing peer authentication on + local connections are particularly vulnerable. Other attacks such + as SQL injection into a postgres_fdw session + are also possible. + Attacking postgres_fdw in this way requires the + ability to create a foreign server object with selected connection + parameters, but any user with access to dblink + could exploit the problem. + In general, an attacker with the ability to select the connection + parameters for a libpq-using application + could cause mischief, though other plausible attack scenarios are + harder to think of. + Our thanks to Andrew Krasichkov for reporting this issue. + (CVE-2018-10915) + + + Ensure that updates to the relfrozenxid diff --git a/doc/src/sgml/release-9.5.sgml b/doc/src/sgml/release-9.5.sgml index 11a219ac5c..1f5ce819f4 100644 --- a/doc/src/sgml/release-9.5.sgml +++ b/doc/src/sgml/release-9.5.sgml @@ -33,6 +33,55 @@ + + + Fix failure to reset libpq's state fully + between connection attempts (Tom Lane) + + + + An unprivileged user of dblink + or postgres_fdw could bypass the checks intended + to prevent use of server-side credentials, such as + a ~/.pgpass file owned by the operating-system + user running the server. Servers allowing peer authentication on + local connections are particularly vulnerable. Other attacks such + as SQL injection into a postgres_fdw session + are also possible. + Attacking postgres_fdw in this way requires the + ability to create a foreign server object with selected connection + parameters, but any user with access to dblink + could exploit the problem. + In general, an attacker with the ability to select the connection + parameters for a libpq-using application + could cause mischief, though other plausible attack scenarios are + harder to think of. + Our thanks to Andrew Krasichkov for reporting this issue. + (CVE-2018-10915) + + + + + + Fix INSERT ... ON CONFLICT UPDATE through a view + that isn't just SELECT * FROM ... + (Dean Rasheed, Amit Langote) + + + + Erroneous expansion of an updatable view could lead to crashes + or attribute ... has the wrong type errors, if the + view's SELECT list doesn't match one-to-one with + the underlying table's columns. + Furthermore, this bug could be leveraged to allow updates of columns + that an attacking user lacks UPDATE privilege for, + if that user has INSERT and UPDATE + privileges for some other column(s) of the table. + Any user could also use it for disclosure of server memory. + (CVE-2018-10925) + + + Ensure that updates to the relfrozenxid @@ -140,21 +189,6 @@ - - - Fix INSERT ... ON CONFLICT UPDATE through a view - that isn't just SELECT * FROM ... - (Dean Rasheed, Amit Langote) - - - - Erroneous expansion of an updatable view could lead to crashes - or attribute ... has the wrong type errors, if the - view's SELECT list doesn't match one-to-one with - the underlying table's columns. - - - Ensure a table's cached index list is correctly rebuilt after an index diff --git a/doc/src/sgml/release-9.6.sgml b/doc/src/sgml/release-9.6.sgml index 0229d705bc..6af9f50c0b 100644 --- a/doc/src/sgml/release-9.6.sgml +++ b/doc/src/sgml/release-9.6.sgml @@ -33,6 +33,55 @@ + + + Fix failure to reset libpq's state fully + between connection attempts (Tom Lane) + + + + An unprivileged user of dblink + or postgres_fdw could bypass the checks intended + to prevent use of server-side credentials, such as + a ~/.pgpass file owned by the operating-system + user running the server. Servers allowing peer authentication on + local connections are particularly vulnerable. Other attacks such + as SQL injection into a postgres_fdw session + are also possible. + Attacking postgres_fdw in this way requires the + ability to create a foreign server object with selected connection + parameters, but any user with access to dblink + could exploit the problem. + In general, an attacker with the ability to select the connection + parameters for a libpq-using application + could cause mischief, though other plausible attack scenarios are + harder to think of. + Our thanks to Andrew Krasichkov for reporting this issue. + (CVE-2018-10915) + + + + + + Fix INSERT ... ON CONFLICT UPDATE through a view + that isn't just SELECT * FROM ... + (Dean Rasheed, Amit Langote) + + + + Erroneous expansion of an updatable view could lead to crashes + or attribute ... has the wrong type errors, if the + view's SELECT list doesn't match one-to-one with + the underlying table's columns. + Furthermore, this bug could be leveraged to allow updates of columns + that an attacking user lacks UPDATE privilege for, + if that user has INSERT and UPDATE + privileges for some other column(s) of the table. + Any user could also use it for disclosure of server memory. + (CVE-2018-10925) + + + Ensure that updates to the relfrozenxid @@ -140,21 +189,6 @@ - - - Fix INSERT ... ON CONFLICT UPDATE through a view - that isn't just SELECT * FROM ... - (Dean Rasheed, Amit Langote) - - - - Erroneous expansion of an updatable view could lead to crashes - or attribute ... has the wrong type errors, if the - view's SELECT list doesn't match one-to-one with - the underlying table's columns. - - - Ensure a table's cached index list is correctly rebuilt after an index