SECURITY RELEASES: 7.2.8 - 7.3.10 - 7.4.8 - 8.0.3
In order to address several security issues identified over the past two
weeks, as well as one "low probability" race condition, we are releasing
new version of PostgreSQL as far back as the 7.2.x branch.
Please note that the security issues were those already reported by Tom
Lane, as well as a manual fix for them. These releases are mainly to
ensure that those installing and/or upgrading existing installations have
those fixes automatically.
For details on the fixes, please see the HISTORY file included in the
Release, but a summary consists of:
* Change encoding function signature to prevent misuse
* Change "contrib/tsearch2" to avoid unsafe use of INTERNAL function
results
* Repair race condition between relation extension and VACUUM
This could theoretically have caused loss of a page's worth of
freshly-inserted data, although the scenario seems of very low
probability. There are no known cases of it having caused more than
an Assert failure.
Downloads are available via:
http://www.postgresql.org/download
Please report any bugs to:
pgsql-bugs@postgresql.org
----
Marc G. Fournier Hub.Org Networking Services (http://www.hub.org)
Email: scrappy@hub.org Yahoo!: yscrappy ICQ: 7615664
Marc G. Fournier wrote:
Please note that the security issues were those already reported by Tom
Lane, as well as a manual fix for them. These releases are mainly to
ensure that those installing and/or upgrading existing installations
have those fixes automatically.
Note that if you're upgrading within a release series (e.g. 8.0.x to
8.0.3) without a dump and reload, you will _not_ get the necessary
system catalog changes automatically. Tom's earlier mail describes the
procedure needed to correct the system catalog:
http://www.postgresql.org/about/news.315
-Neil
Neil Conway <neilc@samurai.com> writes:
Note that if you're upgrading within a release series (e.g. 8.0.x to
8.0.3) without a dump and reload, you will _not_ get the necessary
system catalog changes automatically. Tom's earlier mail describes the
procedure needed to correct the system catalog:
Also, note that that message was the zero-day-security-problem response
to the issue, and that we since figured out cleaner responses. If you
haven't yet implemented this in your own DBs, I would suggest following
the procedures given in the final release notes, eg
http://developer.postgresql.org/docs/postgres/release-7-4-8.html
I expect these notes will shortly show up in the static documentation, eg
http://www.postgresql.org/docs/7.4/static/release.html
but they aren't there yet as I set finger to keyboard.
regards, tom lane
Tom Lane <tgl@sss.pgh.pa.us> writes:
Neil Conway <neilc@samurai.com> writes:
Also, note that that message was the zero-day-security-problem response
to the issue, and that we since figured out cleaner responses. If you
haven't yet implemented this in your own DBs, I would suggest following
the procedures given in the final release notes, eg
http://developer.postgresql.org/docs/postgres/release-7-4-8.html
If we've already done the zero-day fix, is there any value in re-doing
it the "cleaner" way?
-Doug
Douglas McNaught <doug@mcnaught.org> writes:
Tom Lane <tgl@sss.pgh.pa.us> writes:
Also, note that that message was the zero-day-security-problem response
to the issue, and that we since figured out cleaner responses. If you
haven't yet implemented this in your own DBs, I would suggest following
the procedures given in the final release notes, eg
http://developer.postgresql.org/docs/postgres/release-7-4-8.html
If we've already done the zero-day fix, is there any value in re-doing
it the "cleaner" way?
Only if you care about allowing unprivileged users to create conversions
(which seems a bit useless to me, but it's in the regression tests...)
regards, tom lane
I've updated my Perl script to accommodate the version of the
procedures in the final release notes:
http://www.sitening.com/postgresql-update-2005-1
-tfo
--
Thomas F. O'Connell
Co-Founder, Information Architect
Sitening, LLC
Strategic Open Source: Open Your i™
http://www.sitening.com/
110 30th Avenue North, Suite 6
Nashville, TN 37203-6320
615-260-0005
On May 11, 2005, at 12:07 AM, Tom Lane wrote:
Show quoted text
Neil Conway <neilc@samurai.com> writes:
Note that if you're upgrading within a release series (e.g. 8.0.x to
8.0.3) without a dump and reload, you will _not_ get the necessary
system catalog changes automatically. Tom's earlier mail describes the
procedure needed to correct the system catalog:Also, note that that message was the zero-day-security-problem response
to the issue, and that we since figured out cleaner responses. If you
haven't yet implemented this in your own DBs, I would suggest following
the procedures given in the final release notes, eg
http://developer.postgresql.org/docs/postgres/release-7-4-8.htmlI expect these notes will shortly show up in the static documentation,
eg
http://www.postgresql.org/docs/7.4/static/release.html
but they aren't there yet as I set finger to keyboard.regards, tom lane
Hello !
I try the update to PG 8.0.3 win32, but the archive is corrupted !?
I obtain the same thing from all the mirrors where I connect...
How can I obtain the new Win32 release ?
Luc
----- Original Message -----
From: "Neil Conway" <neilc@samurai.com>
To: "Marc G. Fournier" <scrappy@postgresql.org>
Cc: <pgsql-announce@postgresql.org>; <pgsql-general@postgresql.org>
Sent: Wednesday, May 11, 2005 2:39 AM
Subject: Re: [ANNOUNCE] [GENERAL] SECURITY RELEASES: 7.2.8 - 7.3.10 -
7.4.8 - 8.0.3
Show quoted text
Marc G. Fournier wrote:
Please note that the security issues were those already reported by Tom
Lane, as well as a manual fix for them. These releases are mainly to
ensure that those installing and/or upgrading existing installations have
those fixes automatically.Note that if you're upgrading within a release series (e.g. 8.0.x to
8.0.3) without a dump and reload, you will _not_ get the necessary system
catalog changes automatically. Tom's earlier mail describes the procedure
needed to correct the system catalog:http://www.postgresql.org/about/news.315
-Neil
---------------------------(end of broadcast)---------------------------
TIP 6: Have you searched our list archives?
Yes I had that same experience last evening, I was going to write about that
today. But I second your thoughts !
Luc ROLLAND wrote:
Hello !
I try the update to PG 8.0.3 win32, but the archive is corrupted !?
I obtain the same thing from all the mirrors where I connect...How can I obtain the new Win32 release ?
Luc
----- Original Message ----- From: "Neil Conway" <neilc@samurai.com>
To: "Marc G. Fournier" <scrappy@postgresql.org>
Cc: <pgsql-announce@postgresql.org>; <pgsql-general@postgresql.org>
Sent: Wednesday, May 11, 2005 2:39 AM
Subject: Re: [ANNOUNCE] [GENERAL] SECURITY RELEASES: 7.2.8 - 7.3.10 -
7.4.8 - 8.0.3Marc G. Fournier wrote:
Please note that the security issues were those already reported by
Tom Lane, as well as a manual fix for them. These releases are
mainly to ensure that those installing and/or upgrading existing
installations have those fixes automatically.Note that if you're upgrading within a release series (e.g. 8.0.x to
8.0.3) without a dump and reload, you will _not_ get the necessary
system catalog changes automatically. Tom's earlier mail describes the
procedure needed to correct the system catalog:http://www.postgresql.org/about/news.315
-Neil
---------------------------(end of broadcast)---------------------------
TIP 6: Have you searched our list archives?---------------------------(end of broadcast)---------------------------
TIP 2: you can get off all lists at once with the unregister command
(send "unregister YourEmailAddressHere" to majordomo@postgresql.org)
--
Aly Dharshi
aly.dharshi@telus.net
"A good speech is like a good dress
that's short enough to be interesting
and long enough to cover the subject"