From aaca13631a93ab8c5ac9aa36323f62e2fe19fd64 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Tue, 8 Sep 2026 17:27:17 +0900 Subject: [PATCH] doc: Remove unnecessary CVE items from release notes The following CVEs were listed in the release notes of some stable branches, but they should not: - CVE-2026-16238, not on v17 and older - CVE-2026-14676, not on v17 and older - CVE-2026-14681, not on v16 and older - CVE-2026-14672, not on v15 and older Author: Yogesh Sharma Discussion: https://postgr.es/m/340842e1-31ce-4551-9d79-71de490f67e9@CatProSystems.com Backpatch-through: 14-17 --- doc/src/sgml/release-15.sgml | 115 ----------------------------------- 1 file changed, 115 deletions(-) diff --git a/doc/src/sgml/release-15.sgml b/doc/src/sgml/release-15.sgml index e4ed529d4aa..f6ba25cbabf 100644 --- a/doc/src/sgml/release-15.sgml +++ b/doc/src/sgml/release-15.sgml @@ -354,35 +354,6 @@ Branch: REL_14_STABLE [42d333a78] 2026-08-10 06:38:36 -0700 - - Fix multirange type handling - in pg_restore_attribute_stats() - (OpenAI Security Research Team) - - - - pg_restore_attribute_stats() treated multirange - types just like their underlying range type. This works correctly - for the bounds histogram, but it was wrong for all the other - statistics kinds. - - - - The PostgreSQL Project thanks - Amy Burnett (OpenAI Codex Security) - for reporting this problem. - (CVE-2026-16238) - - - - - - - Reject GSSEncRequest after direct SSL connection (Michael Paquier) - - - - After establishing a TLS-encrypted connection, the server would - still accept a request for GSSAPI encryption. If that succeeded, - the connection would proceed using TLS encryption, but it would look - like a GSS connection to the pg_hba rules. - Thus, a pg_hba policy intending to disallow TLS - would not be enforced correctly. - - - - The PostgreSQL Project thanks - p4p3r - for reporting this problem. - (CVE-2026-14681) - - - - - - - Make mock SCRAM authentication secrets more plausible (Nathan Bossart) - - - - If a SCRAM login is attempted against a role that doesn't exist or - doesn't have a SCRAM secret, we generate a mock secret and carry out - the authentication handshake anyway, to avoid revealing these facts - to an attacker. But the mock secret was made with a fixed iteration - count, which in itself can be an observable response discrepancy. - Use the configuration setting scram_iterations - instead, to make the mock secret look more like the installation's - real secrets. - - - - The PostgreSQL Project thanks - Radim Marek - for reporting this problem. - (CVE-2026-14672) - - - - - - - Fix buffer overrun - in contrib/pg_stat_statements (Álvaro Herrera) - - - - Query normalization didn't accurately account for the amount of - space the normalized string would require. - - - - The PostgreSQL Project thanks - Sajeeb Lohani (with TrendAI Zero Day Initiative) and Yuelin Wang - for reporting this problem. - (CVE-2026-14676) - - - - -