From 6499118a9043e40bf7bd7f99ad36968bacf68ffc Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Thu, 13 May 2010 21:27:29 +0000 Subject: [PATCH] Update release notes with security issues. Security: CVE-2010-1169, CVE-2010-1170 --- doc/src/sgml/release-7.4.sgml | 42 ++++++++++++++++++++++++++++++++++- doc/src/sgml/release-8.0.sgml | 42 ++++++++++++++++++++++++++++++++++- doc/src/sgml/release-8.1.sgml | 42 ++++++++++++++++++++++++++++++++++- 3 files changed, 123 insertions(+), 3 deletions(-) diff --git a/doc/src/sgml/release-7.4.sgml b/doc/src/sgml/release-7.4.sgml index ec2704af405..837e781b0a8 100644 --- a/doc/src/sgml/release-7.4.sgml +++ b/doc/src/sgml/release-7.4.sgml @@ -1,4 +1,4 @@ - + @@ -37,6 +37,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Do not allow an unprivileged user to reset superuser-only parameter diff --git a/doc/src/sgml/release-8.0.sgml b/doc/src/sgml/release-8.0.sgml index 590196d193c..6a662d5083a 100644 --- a/doc/src/sgml/release-8.0.sgml +++ b/doc/src/sgml/release-8.0.sgml @@ -1,4 +1,4 @@ - + @@ -37,6 +37,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Do not allow an unprivileged user to reset superuser-only parameter diff --git a/doc/src/sgml/release-8.1.sgml b/doc/src/sgml/release-8.1.sgml index d72ecf25553..cd520abd76b 100644 --- a/doc/src/sgml/release-8.1.sgml +++ b/doc/src/sgml/release-8.1.sgml @@ -1,4 +1,4 @@ - + @@ -31,6 +31,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Do not allow an unprivileged user to reset superuser-only parameter