From c04778592d6db6197819f95028347af135709e4b Mon Sep 17 00:00:00 2001
From: Tom Lane
Date: Mon, 5 Aug 2024 14:03:20 -0400
Subject: Last-minute updates for release notes.
Security: CVE-2024-7348
---
doc/src/sgml/release-16.sgml | 39 +++++++++++++++++++++++++++++++++++++++
1 file changed, 39 insertions(+)
diff --git a/doc/src/sgml/release-16.sgml b/doc/src/sgml/release-16.sgml
index c71f32e469c..acf135b56a8 100644
--- a/doc/src/sgml/release-16.sgml
+++ b/doc/src/sgml/release-16.sgml
@@ -35,6 +35,45 @@
+
+ Prevent unauthorized code execution
+ during pg_dump (Masahiko Sawada)
+
+
+
+ An attacker able to create and drop non-temporary objects could
+ inject SQL code that would be executed by a
+ concurrent pg_dump session with the
+ privileges of the role running pg_dump
+ (which is often a superuser). The attack involves replacing a
+ sequence or similar object with a view or foreign table that will
+ execute malicious code. To prevent this, introduce a new server
+ parameter restrict_nonsystem_relation_kind that
+ can disable expansion of non-builtin views as well as access to
+ foreign tables, and teach pg_dump to set
+ it when available. Note that the attack is prevented only if
+ both pg_dump and the server it is dumping
+ from are new enough to have this fix.
+
+
+
+ The PostgreSQL Project thanks
+ Noah Misch for reporting this problem.
+ (CVE-2024-7348)
+
+
+
+
+