From cb2fffe0d627d3437737ab5293c435b302f6bccf Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 9 Nov 2020 13:02:13 -0500 Subject: [PATCH] Last-minute updates for release notes. Security: CVE-2020-25694, CVE-2020-25695, CVE-2020-25696 --- doc/src/sgml/release-11.sgml | 216 +++++++++++++++++++++++------------ 1 file changed, 143 insertions(+), 73 deletions(-) diff --git a/doc/src/sgml/release-11.sgml b/doc/src/sgml/release-11.sgml index e8c6596af9..a599ab3c81 100644 --- a/doc/src/sgml/release-11.sgml +++ b/doc/src/sgml/release-11.sgml @@ -36,6 +36,149 @@ + + Block DECLARE CURSOR ... WITH HOLD and firing of + deferred triggers within index expressions and materialized view + queries (Noah Misch) + + + + This is essentially a leak in the security restricted + operation sandbox mechanism. An attacker having permission + to create non-temporary SQL objects could parlay this leak to + execute arbitrary SQL code as a superuser. + + + + The PostgreSQL Project thanks + Etienne Stalmans for reporting this problem. + (CVE-2020-25695) + + + + + + + Fix usage of complex connection-string parameters + in pg_dump, + pg_restore, + clusterdb, + reindexdb, + and vacuumdb (Tom Lane) + + + + The parameter + of pg_dump + and pg_restore, or + the parameter of the other + programs mentioned, can be a connection string + containing multiple connection parameters rather than just a + database name. In cases where these programs need to initiate + additional connections, such as parallel processing or processing of + multiple databases, the connection string was forgotten and just the + basic connection parameters (database name, host, port, and + username) were used for the additional connections. This could lead + to connection failures if the connection string included any other + essential information, such as non-default SSL or GSS parameters. + Worse, the connection might succeed but not be encrypted as + intended, or be vulnerable to man-in-the-middle attacks that the + intended connection parameters would have prevented. + (CVE-2020-25694) + + + + + + + When psql's \connect + command re-uses connection parameters, ensure that all + non-overridden parameters from a previous connection string are + re-used (Tom Lane) + + + + This avoids cases where reconnection might fail due to omission of + relevant parameters, such as non-default SSL or GSS options. + Worse, the reconnection might succeed but not be encrypted as + intended, or be vulnerable to man-in-the-middle attacks that the + intended connection parameters would have prevented. + This is largely the same problem as just cited + for pg_dump et al, + although psql's behavior is more complex + since the user may intentionally override some connection + parameters. + (CVE-2020-25694) + + + + + + + Prevent psql's \gset + command from modifying specially-treated variables (Noah Misch) + + + + \gset without a prefix would overwrite whatever + variables the server told it to. Thus, a compromised server could + set specially-treated variables such as PROMPT1, + giving the ability to execute arbitrary shell code in the user's + session. + + + + The PostgreSQL Project thanks + Nick Cleaton for reporting this problem. + (CVE-2020-25696) + + + + + - - Fix usage of complex connection-string parameters - in pg_dump, - pg_restore, - clusterdb, - reindexdb, - and vacuumdb (Tom Lane) - - - - The parameter - of pg_dump - and pg_restore, or - the parameter of the other - programs mentioned, can be a connection string - containing multiple connection parameters rather than just a - database name. In cases where these programs need to initiate - additional connections, such as parallel processing or processing of - multiple databases, the connection string was forgotten and just the - basic connection parameters (database name, host, port, and - username) were used for the additional connections. This could lead - to connection failures if the connection string included any other - essential information, such as non-default SSL or GSS parameters. - - - - - - - When psql's \connect - command re-uses connection parameters, ensure that all - non-overridden parameters from a previous connection string are - re-used (Tom Lane) - - - - This avoids cases where reconnection might fail due to omission of - relevant parameters, such as non-default SSL or GSS options. This - is largely the same problem as just cited - for pg_dump et al, - although psql's behavior is more complex - since the user may intentionally override some connection - parameters. - - - - -