Skip to content

P
Postgres FD Implementation
Commit 89b661ba authored by Tom Lane's avatar Tom Lane
Browse files
Options

Update release notes for 9.2.4, 9.1.9, 9.0.13, 8.4.17. 

Security: CVE-2013-1899, CVE-2013-1901
parent 17fe2793
Hide whitespace changes
Inline Side-by-side
Showing with 70 additions and 0 deletions
doc/src/sgml/release-9.0.sgml
View file @ 89b661ba
...@@ -41,6 +41,20 @@ ...@@ -41,6 +41,20 @@
<itemizedlist> <itemizedlist>
<listitem>
<para>
Fix insecure parsing of server command-line switches (Mitsumasa
Kondo, Kyotaro Horiguchi)
</para>
<para>
A connection request containing a database name that begins with
<quote><literal>-</></quote> could be crafted to damage or destroy
files within the server's data directory, even if the request is
eventually rejected. (CVE-2013-1899)
</para>
</listitem>
<listitem> <listitem>
<para> <para>
Reset OpenSSL randomness state in each postmaster child process Reset OpenSSL randomness state in each postmaster child process
......
doc/src/sgml/release-9.1.sgml
View file @ 89b661ba
...@@ -41,6 +41,20 @@ ...@@ -41,6 +41,20 @@
<itemizedlist> <itemizedlist>
<listitem>
<para>
Fix insecure parsing of server command-line switches (Mitsumasa
Kondo, Kyotaro Horiguchi)
</para>
<para>
A connection request containing a database name that begins with
<quote><literal>-</></quote> could be crafted to damage or destroy
files within the server's data directory, even if the request is
eventually rejected. (CVE-2013-1899)
</para>
</listitem>
<listitem> <listitem>
<para> <para>
Reset OpenSSL randomness state in each postmaster child process Reset OpenSSL randomness state in each postmaster child process
...@@ -56,6 +70,20 @@ ...@@ -56,6 +70,20 @@
</para> </para>
</listitem> </listitem>
<listitem>
<para>
Make REPLICATION privilege checks test current user not authenticated
user (Noah Misch)
</para>
<para>
An unprivileged database user could exploit this mistake to call
<function>pg_start_backup()</> or <function>pg_stop_backup()</>,
thus possibly interfering with creation of routine backups.
(CVE-2013-1901)
</para>
</listitem>
<listitem> <listitem>
<para> <para>
Fix GiST indexes to not use <quote>fuzzy</> geometric comparisons when Fix GiST indexes to not use <quote>fuzzy</> geometric comparisons when
......
doc/src/sgml/release-9.2.sgml
View file @ 89b661ba
...@@ -41,6 +41,20 @@ ...@@ -41,6 +41,20 @@
<itemizedlist> <itemizedlist>
<listitem>
<para>
Fix insecure parsing of server command-line switches (Mitsumasa
Kondo, Kyotaro Horiguchi)
</para>
<para>
A connection request containing a database name that begins with
<quote><literal>-</></quote> could be crafted to damage or destroy
files within the server's data directory, even if the request is
eventually rejected. (CVE-2013-1899)
</para>
</listitem>
<listitem> <listitem>
<para> <para>
Reset OpenSSL randomness state in each postmaster child process Reset OpenSSL randomness state in each postmaster child process
...@@ -56,6 +70,20 @@ ...@@ -56,6 +70,20 @@
</para> </para>
</listitem> </listitem>
<listitem>
<para>
Make REPLICATION privilege checks test current user not authenticated
user (Noah Misch)
</para>
<para>
An unprivileged database user could exploit this mistake to call
<function>pg_start_backup()</> or <function>pg_stop_backup()</>,
thus possibly interfering with creation of routine backups.
(CVE-2013-1901)
</para>
</listitem>
<listitem> <listitem>
<para> <para>
Fix GiST indexes to not use <quote>fuzzy</> geometric comparisons when Fix GiST indexes to not use <quote>fuzzy</> geometric comparisons when
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment