{"id":2096,"date":"2010-10-05T09:44:40","date_gmt":"2010-10-05T17:44:40","guid":{"rendered":"http:\/\/www.chesnok.com\/daily\/?p=2096"},"modified":"2012-03-26T02:51:55","modified_gmt":"2012-03-26T10:51:55","slug":"postgresql-9-0-1-released-includes-security-fix-maintenance-releases-for-6-other-versions","status":"publish","type":"post","link":"https:\/\/www.chesnok.com\/daily\/2010\/10\/05\/postgresql-9-0-1-released-includes-security-fix-maintenance-releases-for-6-other-versions\/","title":{"rendered":"PostgreSQL 9.0.1 released, includes security fix &#038; maintenance releases for 6 other versions"},"content":{"rendered":"<p>The PostgreSQL Global Development group <a href=\"http:\/\/www.postgresql.org\/about\/news.1244\">released new maintenance versions today<\/a>:  9.0.1, 8.4.5, 8.3.12, 8.2.18, 8.1.22, 8.0.26 and 7.4.30. This is the final update for PostgreSQL versions 7.4 and 8.0. There&#8217;s a security issue in there involving procedural languages, and a <a href=\"http:\/\/wiki.postgresql.org\/wiki\/20101005securityrelease\">detailed description of the vulnerability<\/a> is on our <a href=\"http:\/\/wiki.postgresql.org\/\">wiki<\/a>. A key thing to remember is that the issue primarily affects people who use SECURITY DEFINER along with a procedural language function. PL\/PgSQL is not affected, but any other procedural language with a &#8220;trusted&#8221; mode is. This includes PL\/Perl, PL\/tcl, PL\/Python (7.4 or earlier) and others.  The new versions fix issues in PL\/Perl and PL\/tcl.  A patch for PL\/PHP is currently in the works.<\/p>\n<p>Most developers feel that the security issue is relatively obscure. If you aren&#8217;t using a procedural language with some mechanism for altering privileges (SET ROLE or SECURITY DEFINER, for example), you aren&#8217;t vulnerable to the security issue and can upgrade Postgres during your next regularly scheduled downtime. If you *are* vulnerable, we recommend investigating the use of the functions that may be vulnerable, and taking steps to prevent their exploitation by upgrading as soon as you can.<\/p>\n<p><a href=\"http:\/\/wiki.postgresql.org\/wiki\/20101005securityrelease\">From the FAQ<\/a>: <\/p>\n<blockquote><p>\nWhat is the level of risk associated with this exploit?<\/p>\n<p>Low. It requires all of the following:<\/p>\n<ul>\n<li>An attacker must have an authenticated connection to the database server.\n<\/li>\n<li>The attacker must be able to execute arbitrary statements over that connection.\n<\/li>\n<li>The attacker must have an strong knowledge of PostgreSQL.\n<\/li>\n<li>Your application must include procedures or functions in an external procedural language.\n<\/li>\n<li>These functions and procedures must be executed by users with greater privileges than the attacker, using SECURITY DEFINER or SET ROLE, and using the same connection as the attacker.\n<\/li>\n<\/ul>\n<\/blockquote>\n<p>This was also the first release for which I generated release notes! \ud83d\ude00<\/p>\n<p>Here was my list of interesting changes for the announcement: <\/p>\n<ul>\n<li>Prevent show_session_authorization() from crashing within autovacuum processes, backpatched to all supported versions;<\/li>\n<li>Fix connection leak after duplicate connection name errors, fix handling of connection names longer than 62 bytes and improve contrib\/dblink&#8217;s handling of tables containing dropped columns, backpatched to all supported versions;<\/li>\n<li>Defend against functions returning setof record where not all the returned rows are actually of the same rowtype, backpatched to 8.0;<\/li>\n<li>Fix possible duplicate scans of UNION ALL member relations, backpatched to 8.2;<\/li>\n<li>Reduce PANIC to ERROR on infrequent btree failure cases, backpatched to 8.2;<\/li>\n<li>Add hstore(text, text) function to contrib\/hstore, to support migration away from the => operator, which was deprecated in 9.0. Function support backpatched to 8.2;<\/li>\n<li>Treat exit code 128 as non-fatal on Win32, backpatched to 8.2;<\/li>\n<li>Fix failure to mark cached plans as transient, causing CREATE INDEX CONCURRENTLY to not be used right away, backpatched to 8.3;<\/li>\n<li>Fix evaluation of inner side of an outer join is a sub-select with non-strict expressions in its output list, backpatched to 8.4;<\/li>\n<li>Allow full SSL certificate verification to succeed in the case where both host and hostaddr are specified, backpatched to 8.4;<\/li>\n<li>Improve parallel restore&#8217;s ability to cope with selective restore (-L option), backpatched to 8.4 with caveats;<\/li>\n<li>Fix failure of &#8220;ALTER TABLE t ADD COLUMN c serial&#8221; when done by non-owner, 9.0 only.<\/li>\n<li>Several bugfixes for join removal, 9.0 only.<\/li>\n<\/ul>\n<p>If you have a look at a new tool that Robert Haas and Tom Lane commited to the repo called <a href=\"http:\/\/git.postgresql.org\/gitweb?p=postgresql.git;a=blob;f=src\/tools\/git_changelog;h=af76f6d0ccbf550a75db84d4348dca68f0fa699b;hb=HEAD\">git_changelog<\/a>, you can use it to find the commit IDs for the various features (you need the whole source tree to do it :)).  <\/p>\n<p>You&#8217;ll find that there are a lot of commits in these sets. We haven&#8217;t had a minor release since May 2010, so they kind of added up.<\/p>\n<p>Any other changes in there you think we should have mentioned in the announcement? Let me know in the comments.<\/p>\n<p>Download new versions now:<\/p>\n<ul>\n<li><a href=\"http:\/\/postgresql.org\/download\">Main download page<\/a><\/li>\n<li><a href=\"http:\/\/postgresql.org\/\/ftp\/source\/\">Source code<\/a><\/li>\n<li><a href=\"http:\/\/postgresql.org\/\/ftp\/binary\/\">Binary packages<\/a><\/li>\n<li><a href=\"http:\/\/www.enterprisedb.com\/products\/pgdownload.do\">One-click installer, including Mac and Windows packages<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The PostgreSQL Global Development group <a href=\"http:\/\/www.postgresql.org\/about\/news.1244\">released new maintenance versions today<\/a>:  9.0.1, 8.4.5, 8.3.12, 8.2.18, 8.1.22, 8.0.26 and 7.4.30. This is the final update for PostgreSQL versions 7.4 and 8.0. There&#8217;s a security issue in there involving procedural languages, and a <a href=\"http:\/\/wiki.postgresql.org\/wiki\/20101005securityrelease\">detailed description of the vulnerability<\/a> is on our <a href=\"http:\/\/wiki.postgresql.org\/\">wiki<\/a>. A key thing to remember is that the issue primarily affects people who use SECURITY DEFINER along with a procedural language function. PL\/PgSQL is not affected, but any other procedural language with a &#8220;trusted&#8221; mode is. This includes PL\/Perl, PL\/tcl, PL\/Python and others.  The new versions fix issues in PL\/Perl and PL\/tcl.  A patch for PL\/PHP is currently in the works. &hellip; <a href=\"https:\/\/www.chesnok.com\/daily\/2010\/10\/05\/postgresql-9-0-1-released-includes-security-fix-maintenance-releases-for-6-other-versions\/\">Continue reading &rarr;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[97,9],"tags":[647,624,351,363],"class_list":["post-2096","post","type-post","status-publish","format-standard","hentry","category-postgres","category-postgresql","tag-postgres","tag-postgresql","tag-release","tag-security-announcement"],"_links":{"self":[{"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/posts\/2096","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/comments?post=2096"}],"version-history":[{"count":10,"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/posts\/2096\/revisions"}],"predecessor-version":[{"id":3953,"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/posts\/2096\/revisions\/3953"}],"wp:attachment":[{"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/media?parent=2096"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/categories?post=2096"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.chesnok.com\/daily\/wp-json\/wp\/v2\/tags?post=2096"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}