PostgreSQL 9.0.1 released, includes security fix & maintenance releases for 6 other versions

The PostgreSQL Global Development group released new maintenance versions today: 9.0.1, 8.4.5, 8.3.12, 8.2.18, 8.1.22, 8.0.26 and 7.4.30. This is the final update for PostgreSQL versions 7.4 and 8.0. There’s a security issue in there involving procedural languages, and a detailed description of the vulnerability is on our wiki. A key thing to remember is that the issue primarily affects people who use SECURITY DEFINER along with a procedural language function. PL/PgSQL is not affected, but any other procedural language with a “trusted” mode is. This includes PL/Perl, PL/tcl, PL/Python (7.4 or earlier) and others. The new versions fix issues in PL/Perl and PL/tcl. A patch for PL/PHP is currently in the works.

Most developers feel that the security issue is relatively obscure. If you aren’t using a procedural language with some mechanism for altering privileges (SET ROLE or SECURITY DEFINER, for example), you aren’t vulnerable to the security issue and can upgrade Postgres during your next regularly scheduled downtime. If you *are* vulnerable, we recommend investigating the use of the functions that may be vulnerable, and taking steps to prevent their exploitation by upgrading as soon as you can.

From the FAQ:

What is the level of risk associated with this exploit?

Low. It requires all of the following:

  • An attacker must have an authenticated connection to the database server.
  • The attacker must be able to execute arbitrary statements over that connection.
  • The attacker must have an strong knowledge of PostgreSQL.
  • Your application must include procedures or functions in an external procedural language.
  • These functions and procedures must be executed by users with greater privileges than the attacker, using SECURITY DEFINER or SET ROLE, and using the same connection as the attacker.

This was also the first release for which I generated release notes! :D

Here was my list of interesting changes for the announcement:

  • Prevent show_session_authorization() from crashing within autovacuum processes, backpatched to all supported versions;
  • Fix connection leak after duplicate connection name errors, fix handling of connection names longer than 62 bytes and improve contrib/dblink’s handling of tables containing dropped columns, backpatched to all supported versions;
  • Defend against functions returning setof record where not all the returned rows are actually of the same rowtype, backpatched to 8.0;
  • Fix possible duplicate scans of UNION ALL member relations, backpatched to 8.2;
  • Reduce PANIC to ERROR on infrequent btree failure cases, backpatched to 8.2;
  • Add hstore(text, text) function to contrib/hstore, to support migration away from the => operator, which was deprecated in 9.0. Function support backpatched to 8.2;
  • Treat exit code 128 as non-fatal on Win32, backpatched to 8.2;
  • Fix failure to mark cached plans as transient, causing CREATE INDEX CONCURRENTLY to not be used right away, backpatched to 8.3;
  • Fix evaluation of inner side of an outer join is a sub-select with non-strict expressions in its output list, backpatched to 8.4;
  • Allow full SSL certificate verification to succeed in the case where both host and hostaddr are specified, backpatched to 8.4;
  • Improve parallel restore’s ability to cope with selective restore (-L option), backpatched to 8.4 with caveats;
  • Fix failure of “ALTER TABLE t ADD COLUMN c serial” when done by non-owner, 9.0 only.
  • Several bugfixes for join removal, 9.0 only.

If you have a look at a new tool that Robert Haas and Tom Lane commited to the repo called git_changelog, you can use it to find the commit IDs for the various features (you need the whole source tree to do it :) ).

You’ll find that there are a lot of commits in these sets. We haven’t had a minor release since May 2010, so they kind of added up.

Any other changes in there you think we should have mentioned in the announcement? Let me know in the comments.

Download new versions now:

Weekly tweet digest for 2010-10-03

  • Ok, didn't manage to get business cards printed. Any suggestions on a place to do them in NYC Mon/Tues? #ghc #lastminute #
  • Doubles from A & A http://flic.kr/p/8EsmJa #
  • Butter (new chicken) http://flic.kr/p/8EsQdV #
  • Placement http://flic.kr/p/8EyEKM #
  • Moon cake http://flic.kr/p/8EP3az #
  • On the train to EWR. Had my last bike ride in brooklyn and tasty doubles from A&A for a while. #
  • Experiencing opening remarks – giant video! http://twitpic.com/2tbt7k #ghc10 #
  • More than 2000 people attending #ghc10 #
  • OH: "All day long, I'm surrounded by men. And I get tired of looking at them." -Duy-Loan T. Le #
  • Duy-Loan T. Le at http://twitpic.com/2tc448 #ghc10 #
  • "Relationship building requires face-to-face connection." #ghc10 #preachit #
  • "what is considered excellence in one culture doesn't necessarily translate into another culture" #ghc10 — so true in FOSS cultures #
  • "plausable promise" – learn to release before things are completely done – @saraford — cool term #
  • "plausable promise" – learn to release before things are completely done – @saraford — cool term #ghc10 #fosstrack #
  • My business card at Grace Hopper #ghc10 http://twitpic.com/2tde6y #
  • About to participate in the panel on getting started in free and open source software. #ghc10 #
  • "a simple little fortran do loop. you don't know what that is either." -Carol Bartz #ghc10 #
  • dude. Carol Bartz just said 'biotch' and 'biotch wings' #ghc10 #
  • "You have to manage your own career… Volunteer for things." -Carol Bartz #ghc10 #
  • "Don't think of your career as a ladder – ladders are very unstable." -Carol Bartz #ghc10 #
  • Thanks so much to @lhawthorn for organizing the starting in FOSS panel with @PINguAR @terriko, Deb Nicholson and Greg Hislop and me! #ghc10 #
  • Wow, Carol Bartz's keynote was epic. #ghc10 #
  • Some Android apps caught covertly sending GPS data to advertisers arst.ch/mmq via @arstechnica #noyoudint #
  • Listening to Gayatri Buragohain, the founder of http://www.fat-net.org/ talk about how she got started. She just won an award at #ghc10 #
  • heartfelt speach from Tayana Etienne, who was crucial in developing NGO collaboration in Haiti after the earthquake in January. #ghc10 #
  • Laura Haas now accepting an award for technical leadership.. cites collaboration, apprenticeship as the foundation of her success :) #ghc10 #
  • "I just think about how to get people to play with me on my next project." -Laura Haas #ghc10 #
  • Omg. Dance party started at #ghc10 Headed back to the hackathon. #immanerd #
  • Guess who rules? @claire_mccabe with her bringing me a glass of wine :) in reply to claire_mccabe #
  • Fran and others hacking http://flic.kr/p/8FrBKQ #
  • Fran, louiqa and pat http://flic.kr/p/8FrJmj #
  • listening to carla gomes talk about computational sustainability – aim to apply tech from compsci to sustainability research. #ghc10 #
  • Big challenge: establish interdisciplinary relationships and collaborate across fields (computational sustainability) #ghc10 #
  • loving carla gomes' use of smilie and frownie faces on slides about "diffusion process as local stochastic activation rules" #ghc10 #
  • Referencing this paper: http://bit.ly/aF5BbH in solving problem of land buying to increase population of endangered birds #ghc10 #
  • Building poverty maps is similar to species maps, and modeling process of migration – influencing cascades, picking best strategy #ghc10 #
  • Leadership: always think about how to generalize what you are doing. -Carla Gomes #ghc10 #
  • Imposter syndrome thought to be esp common wih women, but found to occur equally with men. #ghc10 #
  • "'You have just processed a petabyte of data.' Oops." #ghc10 #mapreduce #
  • PSA: biotch-wings http://www.flickr.com/photos/gailcarmichael/5041609463/in/set-72157624932418433/ #ghc10 #
  • In a talk on mentoring challenges and they are acting out a skit. Awesome!! #ghc10 #
  • OH: you should focus on the lack of spatial awareness as a commonality #ghc10 #
  • Enjoying the #ghc10 afterparty #
  • totally excited about a new project. #shiny #

twittering on 2010-10-02

  • listening to carla gomes talk about computational sustainability – aim to apply tech from compsci to sustainability research. #ghc10 #
  • Big challenge: establish interdisciplinary relationships and collaborate across fields (computational sustainability) #ghc10 #
  • loving carla gomes' use of smilie and frownie faces on slides about "diffusion process as local stochastic activation rules" #ghc10 #
  • Referencing this paper: http://bit.ly/aF5BbH in solving problem of land buying to increase population of endangered birds #ghc10 #
  • Building poverty maps is similar to species maps, and modeling process of migration – influencing cascades, picking best strategy #ghc10 #
  • Leadership: always think about how to generalize what you are doing. -Carla Gomes #ghc10 #
  • Imposter syndrome thought to be esp common wih women, but found to occur equally with men. #ghc10 #
  • "'You have just processed a petabyte of data.' Oops." #ghc10 #mapreduce #
  • PSA: biotch-wings http://www.flickr.com/photos/gailcarmichael/5041609463/in/set-72157624932418433/ #ghc10 #
  • In a talk on mentoring challenges and they are acting out a skit. Awesome!! #ghc10 #
  • OH: you should focus on the lack of spatial awareness as a commonality #ghc10 #
  • Enjoying the #ghc10 afterparty #

Thoughts on Grace Hopper

I’ve been at Grace Hopper Celebration of Women in Computing for the past two days – soaking in the presence of over 2000 women in computing at a sprawling conference here in Atlanta.

The interesting thing about this conference is how much the same it feels to me as any other large conference I attend, and a couple small ways that it is very different. I realized while I was here how I have spent the last few years surrounding myself with accomplished, amazing women like Jen Redman, Leslie Hawthorn, Claire McCabe and Sarah Sharp. What’s funny is that we’re connected by Portland (although Claire is down in Oakland… for now…), and we’re all at Grace Hopper this week. They, among many others, made me feel right at home.

I feel the dislocation of being at a conference comprised 95% (or more) of women. There’s an odd politeness that I’m not used to. There are a lot of people who are in academia or industry who wear suits and use words like ‘leverage’ without irony. There were tons of students – over 900 of them, and an incredible job fair. And I was shocked at the number of people who asked me: What exactly is free and open source software?

As congratulatory as those of us who are “in” the free software world about having essentially won out over proprietary software, there is a huge, mainstream portion of the computing world who are not aware. I’m not saying that a person needs to understand the minutia of license differences, or have even read one. But wow, there is an incredible missed opportunity when a computer science student can graduate without knowing what open source even *is*.

So, congratulations to the women who put the first ever Open Source Track at Grace Hopper together: Jen Redman, Cat Allman, Sandra Covington, Sara Ford, Jenny Han Donnelly, Leslie Hawthorn, Avni Khatri, Stormy Peters, Hilary Pike, and Natalia Vinnik. I was very happy to participate in the “getting started in open source” panel. And many thanks to the NSA for sponsoring the hackathon with Sahana, a very worthy project, and one that I hope is infused with new excitement and contribution from the 200 people who signed up to participate. I hear that we’ll be having a hackathon again next year in Portland — when Grace Hopper comes to our very own city!

twittering on 2010-10-01

  • Experiencing opening remarks – giant video! http://twitpic.com/2tbt7k #ghc10 #
  • More than 2000 people attending #ghc10 #
  • OH: "All day long, I'm surrounded by men. And I get tired of looking at them." -Duy-Loan T. Le #
  • Duy-Loan T. Le at http://twitpic.com/2tc448 #ghc10 #
  • "Relationship building requires face-to-face connection." #ghc10 #preachit #
  • "what is considered excellence in one culture doesn't necessarily translate into another culture" #ghc10 — so true in FOSS cultures #
  • "plausable promise" – learn to release before things are completely done – @saraford — cool term #
  • "plausable promise" – learn to release before things are completely done – @saraford — cool term #ghc10 #fosstrack #
  • My business card at Grace Hopper #ghc10 http://twitpic.com/2tde6y #
  • About to participate in the panel on getting started in free and open source software. #ghc10 #
  • "a simple little fortran do loop. you don't know what that is either." -Carol Bartz #ghc10 #
  • dude. Carol Bartz just said 'biotch' and 'biotch wings' #ghc10 #
  • "You have to manage your own career… Volunteer for things." -Carol Bartz #ghc10 #
  • "Don't think of your career as a ladder – ladders are very unstable." -Carol Bartz #ghc10 #
  • Thanks so much to @lhawthorn for organizing the starting in FOSS panel with @PINguAR @terriko, Deb Nicholson and Greg Hislop and me! #ghc10 #
  • Wow, Carol Bartz's keynote was epic. #ghc10 #
  • Some Android apps caught covertly sending GPS data to advertisers arst.ch/mmq via @arstechnica #noyoudint #
  • Listening to Gayatri Buragohain, the founder of http://www.fat-net.org/ talk about how she got started. She just won an award at #ghc10 #
  • heartfelt speach from Tayana Etienne, who was crucial in developing NGO collaboration in Haiti after the earthquake in January. #ghc10 #
  • Laura Haas now accepting an award for technical leadership.. cites collaboration, apprenticeship as the foundation of her success :) #ghc10 #
  • "I just think about how to get people to play with me on my next project." -Laura Haas #ghc10 #
  • Omg. Dance party started at #ghc10 Headed back to the hackathon. #immanerd #
  • Guess who rules? @claire_mccabe with her bringing me a glass of wine :) in reply to claire_mccabe #
  • Fran and others hacking http://flic.kr/p/8FrBKQ #
  • Fran, louiqa and pat http://flic.kr/p/8FrJmj #