diff --git a/doc/src/sgml/release-11.sgml b/doc/src/sgml/release-11.sgml index b11741bfd34..28cc7a3e6d8 100644 --- a/doc/src/sgml/release-11.sgml +++ b/doc/src/sgml/release-11.sgml @@ -35,6 +35,43 @@ + + Fix buffer-overflow hazards in SCRAM verifier parsing + (Jonathan Katz, Heikki Linnakangas, Michael Paquier) + + + + Any authenticated user could cause a stack-based buffer overflow by + changing their own password to a purpose-crafted value. In addition + to the ability to crash the PostgreSQL + server, this could suffice for executing arbitrary code as + the PostgreSQL operating system account. + + + + A similar overflow hazard existed + in libpq, which could allow a rogue + server to crash a client or perhaps execute arbitrary code as the + client's operating system account. + + + + The PostgreSQL Project thanks Alexander + Lakhin for reporting this problem. (CVE-2019-10164) + + + + + - - Avoid spurious deadlock failures when upgrading a tuple lock (Oleksii - Kliukin) - - - - -