From 1eb5d43beed9d8cdc61377867f0a53eb2cfba0c4 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 5 Feb 2018 14:43:40 -0500 Subject: [PATCH] Last-minute updates for release notes. Security: CVE-2018-1052, CVE-2018-1053 --- doc/src/sgml/release-10.sgml | 49 +++++++++++++++++++++++++++++++++++ doc/src/sgml/release-9.3.sgml | 22 ++++++++++++++++ doc/src/sgml/release-9.4.sgml | 22 ++++++++++++++++ doc/src/sgml/release-9.5.sgml | 22 ++++++++++++++++ doc/src/sgml/release-9.6.sgml | 22 ++++++++++++++++ 5 files changed, 137 insertions(+) diff --git a/doc/src/sgml/release-10.sgml b/doc/src/sgml/release-10.sgml index 3159f7a21f..7b0fde2b93 100644 --- a/doc/src/sgml/release-10.sgml +++ b/doc/src/sgml/release-10.sgml @@ -41,6 +41,55 @@ + + Fix processing of partition keys containing multiple expressions + (Álvaro Herrera, David Rowley) + + + + This error led to crashes or, with carefully crafted input, disclosure + of arbitrary backend memory. + (CVE-2018-1052) + + + + + + + Ensure that all temporary files made + by pg_upgrade are non-world-readable + (Tom Lane, Noah Misch) + + + + pg_upgrade normally restricts its + temporary files to be readable and writable only by the calling user. + But the temporary file containing pg_dumpall -g + output would be group- or world-readable, or even writable, if the + user's umask setting allows. In typical usage on + multi-user machines, the umask and/or the working + directory's permissions would be tight enough to prevent problems; + but there may be people using pg_upgrade + in scenarios where this oversight would permit disclosure of database + passwords to unfriendly eyes. + (CVE-2018-1053) + + + + +