8000 Last-minute updates for release notes. · limezra/postgres@27a6585 · GitHub
[go: up one dir, main page]
Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings
This repository was archived by the owner on Aug 17, 2020. It is now read-only.

Commit 27a6585

Browse files
tglsfdctglsfdc
committed
Last-minute updates for release notes.
Security: CVE-2018-1115
1 parent 20f01fc commit 27a6585

File tree

2 files changed

+76
-6
lines changed

2 files changed

+76
-6
lines changed

‎doc/src/sgml/release-10.sgml

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,14 @@
2323
</para>
2424

2525
<para>
26-
However, if the function marking mistakes mentioned in the first two
27-
changelog entries below affect you, you will want to take steps to
28-
correct your database catalogs.
26+
However, if you use the <filename>adminpack</filename> extension,
27+
you should update it as per the first changelog entry below.
28+
</para>
29+
30+
<para>
31+
Also, if the function marking mistakes mentioned in the second and
32+
third changelog entries below affect you, you will want to take steps
33+
to correct your database catalogs.
2934
</para>
3035

3136
<para>
@@ -41,6 +46,39 @@
4146

4247
<listitem>
4348
<!--
49+
Author: Stephen Frost <sfrost@snowman.net>
50+
Branch: master [7b347409f] 2018-05-07 10:10:33 -0400
51+
Branch: REL_10_STABLE [20f01fc45] 2018-05-07 10:10:41 -0400
52+
Branch: REL9_6_STABLE [53b79ab4f] 2018-05-07 10:10:45 -0400
53+
-->
54+
<para>
55+
Remove public execute privilege
56+
from <filename>contrib/adminpack</filename>'s
57+
<function>pg_logfile_rotate()</function> function (Stephen Frost)
58+
</para>
59+
60+
<para>
61+
<function>pg_logfile_rotate()</function> is a deprecated wrapper
62+
for the core function <function>pg_rotate_logfile()</function>.
63+
When that function was changed to rely on SQL privileges for access
64+
control rather than a hard-coded superuser
65+
check, <function>pg_logfile_rotate()</function> should have been
66+
updated as well, but the need for this was missed. Hence,
67+
if <filename>adminpack</filename> is installed, any user could
68+
request a logfile rotation, creating a minor security issue.
69+
</para>
70+
71+
<para>
72+
After installing this update, administrators should
73+
update <filename>adminpack</filename> by performing
74+
<literal>ALTER EXTENSION adminpack UPDATE</literal> in each
75+
database in which <filename>adminpack</filename> is installed.
76+
(CVE-2018-1115)
77+
</para>
78+
</listitem>
79+
80+
<listitem>
81+
<!--
4482
Author: Tom Lane <tgl@sss.pgh.pa.us>
4583
Branch: master [11002f8af] 2018-03-30 18:14:51 -0400
4684
Branch: REL_10_STABLE [283262cd9] 2018-03-30 18:14:51 -0400

‎doc/src/sgml/release-9.6.sgml

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,14 @@
2323
</para>
2424

2525
<para>
26-
However, if the function marking mistakes mentioned in the first two
27-
changelog entries below affect you, you will want to take steps to
28-
correct your database catalogs.
26+
However, if you use the <filename>adminpack</filename> extension,
27+
you should update it as per the first changelog entry below.
28+
</para>
29+
30+
<para>
31+
Also, if the function marking mistakes mentioned in the second and
32+
third changelog entries below affect you, you will want to take steps
33+
to correct your database catalogs.
2934
</para>
3035

3136
<para>
@@ -39,6 +44,33 @@
3944

4045
<itemizedlist>
4146

47+
<listitem>
48+
<para>
49+
Remove public execute privilege
50+
from <filename>contrib/adminpack</filename>'s
51+
<function>pg_logfile_rotate()</function> function (Stephen Frost)
52+
</para>
53+
54+
<para>
55+
<function>pg_logfile_rotate()</function> is a deprecated wrapper
56+
for the core function <function>pg_rotate_logfile()</function>.
57+
When that function was changed to rely on SQL privileges for access
58+
control rather than a hard-coded superuser
59+
check, <function>pg_logfile_rotate()</function> should have been
60+
updated as well, but the need for this was missed. Hence,
61+
if <filename>adminpack</filename> is installed, any user could
62+
request a logfile rotation, creating a minor security issue.
63+
</para>
64+
65+
<para>
66+
After installing this update, administrators should
67+
update <filename>adminpack</filename> by performing
68+
<literal>ALTER EXTENSION adminpack UPDATE</literal> in each
69+
database in which <filename>adminpack</filename> is installed.
70+
(CVE-2018-1115)
71+
</para>
72+
</listitem>
73+
4274
<listitem>
4375
<para>
4476
Fix incorrect volatility markings on a few built-in functions

0 commit comments

Comments
 (0)
0