database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-02 11:44:50 +03:00
Code

Last-minute updates for release notes.

Browse Source 
Security: CVE-2020-14349, CVE-2020-14350
This commit is contained in:
Tom Lane 2020-08-10 15:35:46 -04:00
parent 2ea8a60fc4
commit a7e51a4076
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
doc/src/sgml/release-9.6.sgml
View File

@ -35,6 +35,39 @@
<listitem> <listitem>
<!-- <!--
Author: Tom Lane <tgl@sss.pgh.pa.us>
Branch: master [7eeb1d986] 2020-08-10 10:44:42 -0400
Branch: REL_13_STABLE [98ca64899] 2020-08-10 10:44:42 -0400
Branch: REL_12_STABLE [3ba967084] 2020-08-10 10:44:42 -0400
Branch: REL_11_STABLE [afa358786] 2020-08-10 10:44:43 -0400
Branch: REL_10_STABLE [96cbfe92d] 2020-08-10 10:44:43 -0400
Branch: REL9_6_STABLE [2ea8a60fc] 2020-08-10 10:44:43 -0400
Branch: REL9_5_STABLE [6b11a4687] 2020-08-10 10:44:43 -0400
-->
<para>
Make contrib modules' installation scripts more secure (Tom Lane)
</para>
<para>
Attacks similar to those described in CVE-2018-1058 could be carried
out against an extension installation script, if the attacker can
create objects in either the extension's target schema or the schema
of some prerequisite extension. Since extensions often require
superuser privilege to install, this can open a path to obtaining
superuser privilege. To mitigate this risk, be more careful about
the <varname>search_path</varname> used to run an installation
script; disable <varname>check_function_bodies</varname> within the
script; and fix catalog-adjustment queries used in some contrib
modules to ensure they are secure. Also provide documentation to
help third-party extension authors make their installation scripts
secure. This is not a complete solution; extensions that depend on
other extensions can still be at risk if installed carelessly.
(CVE-2020-14350)
</para>
</listitem>
<listitem>
<!--
Author: Alvaro Herrera <alvherre@alvh.no-ip.org> Author: Alvaro Herrera <alvherre@alvh.no-ip.org>
Branch: master [470687b4a] 2020-08-08 12:31:55 -0400 Branch: master [470687b4a] 2020-08-08 12:31:55 -0400
Branch: REL_13_STABLE [900429d0c] 2020-08-08 12:31:55 -0400 Branch: REL_13_STABLE [900429d0c] 2020-08-08 12:31:55 -0400