Thread: SECURITY RELEASES: 7.2.8 - 7.3.10 - 7.4.8 - 8.0.3
In order to address several security issues identified over the past two
weeks, as well as one "low probability" race condition, we are releasing
new version of PostgreSQL as far back as the 7.2.x branch.
Please note that the security issues were those already reported by Tom
Lane, as well as a manual fix for them. These releases are mainly to
ensure that those installing and/or upgrading existing installations have
those fixes automatically.
For details on the fixes, please see the HISTORY file included in the
Release, but a summary consists of:
* Change encoding function signature to prevent misuse
* Change "contrib/tsearch2" to avoid unsafe use of INTERNAL function
results
* Repair race condition between relation extension and VACUUM
This could theoretically have caused loss of a page's worth of
freshly-inserted data, although the scenario seems of very low
probability. There are no known cases of it having caused more than
an Assert failure.
Downloads are available via:
http://www.postgresql.org/download
Please report any bugs to:
pgsql-bugs@postgresql.org
----
Marc G. Fournier Hub.Org Networking Services (http://www.hub.org)
Email: scrappy@hub.org Yahoo!: yscrappy ICQ: 7615664
Marc G. Fournier wrote:
> Please note that the security issues were those already reported by Tom
> Lane, as well as a manual fix for them. These releases are mainly to
> ensure that those installing and/or upgrading existing installations
> have those fixes automatically.
Note that if you're upgrading within a release series (e.g. 8.0.x to
8.0.3) without a dump and reload, you will _not_ get the necessary
system catalog changes automatically. Tom's earlier mail describes the
procedure needed to correct the system catalog:
http://www.postgresql.org/about/news.315
-Neil
Neil Conway <neilc@samurai.com> writes: > Note that if you're upgrading within a release series (e.g. 8.0.x to > 8.0.3) without a dump and reload, you will _not_ get the necessary > system catalog changes automatically. Tom's earlier mail describes the > procedure needed to correct the system catalog: > http://www.postgresql.org/about/news.315 Also, note that that message was the zero-day-security-problem response to the issue, and that we since figured out cleaner responses. If you haven't yet implemented this in your own DBs, I would suggest following the procedures given in the final release notes, eg http://developer.postgresql.org/docs/postgres/release-7-4-8.html I expect these notes will shortly show up in the static documentation, eg http://www.postgresql.org/docs/7.4/static/release.html but they aren't there yet as I set finger to keyboard. regards, tom lane
Tom Lane <tgl@sss.pgh.pa.us> writes: > Neil Conway <neilc@samurai.com> writes: >> http://www.postgresql.org/about/news.315 > > Also, note that that message was the zero-day-security-problem response > to the issue, and that we since figured out cleaner responses. If you > haven't yet implemented this in your own DBs, I would suggest following > the procedures given in the final release notes, eg > http://developer.postgresql.org/docs/postgres/release-7-4-8.html If we've already done the zero-day fix, is there any value in re-doing it the "cleaner" way? -Doug
Douglas McNaught <doug@mcnaught.org> writes: > Tom Lane <tgl@sss.pgh.pa.us> writes: >> Also, note that that message was the zero-day-security-problem response >> to the issue, and that we since figured out cleaner responses. If you >> haven't yet implemented this in your own DBs, I would suggest following >> the procedures given in the final release notes, eg >> http://developer.postgresql.org/docs/postgres/release-7-4-8.html > If we've already done the zero-day fix, is there any value in re-doing > it the "cleaner" way? Only if you care about allowing unprivileged users to create conversions (which seems a bit useless to me, but it's in the regression tests...) regards, tom lane
I've updated my Perl script to accommodate the version of the procedures in the final release notes: http://www.sitening.com/postgresql-update-2005-1 -tfo -- Thomas F. O'Connell Co-Founder, Information Architect Sitening, LLC Strategic Open Source: Open Your i™ http://www.sitening.com/ 110 30th Avenue North, Suite 6 Nashville, TN 37203-6320 615-260-0005 On May 11, 2005, at 12:07 AM, Tom Lane wrote: > Neil Conway <neilc@samurai.com> writes: >> Note that if you're upgrading within a release series (e.g. 8.0.x to >> 8.0.3) without a dump and reload, you will _not_ get the necessary >> system catalog changes automatically. Tom's earlier mail describes the >> procedure needed to correct the system catalog: > >> http://www.postgresql.org/about/news.315 > > Also, note that that message was the zero-day-security-problem response > to the issue, and that we since figured out cleaner responses. If you > haven't yet implemented this in your own DBs, I would suggest following > the procedures given in the final release notes, eg > http://developer.postgresql.org/docs/postgres/release-7-4-8.html > > I expect these notes will shortly show up in the static documentation, > eg > http://www.postgresql.org/docs/7.4/static/release.html > but they aren't there yet as I set finger to keyboard. > > regards, tom lane
Hello ! I try the update to PG 8.0.3 win32, but the archive is corrupted !? I obtain the same thing from all the mirrors where I connect... How can I obtain the new Win32 release ? Luc ----- Original Message ----- From: "Neil Conway" <neilc@samurai.com> To: "Marc G. Fournier" <scrappy@postgresql.org> Cc: <pgsql-announce@postgresql.org>; <pgsql-general@postgresql.org> Sent: Wednesday, May 11, 2005 2:39 AM Subject: Re: [ANNOUNCE] [GENERAL] SECURITY RELEASES: 7.2.8 - 7.3.10 - 7.4.8 - 8.0.3 > Marc G. Fournier wrote: >> Please note that the security issues were those already reported by Tom >> Lane, as well as a manual fix for them. These releases are mainly to >> ensure that those installing and/or upgrading existing installations have >> those fixes automatically. > > Note that if you're upgrading within a release series (e.g. 8.0.x to > 8.0.3) without a dump and reload, you will _not_ get the necessary system > catalog changes automatically. Tom's earlier mail describes the procedure > needed to correct the system catalog: > > http://www.postgresql.org/about/news.315 > > -Neil > > ---------------------------(end of broadcast)--------------------------- > TIP 6: Have you searched our list archives? > > http://archives.postgresql.org >
Yes I had that same experience last evening, I was going to write about that today. But I second your thoughts ! Luc ROLLAND wrote: > Hello ! > > I try the update to PG 8.0.3 win32, but the archive is corrupted !? > I obtain the same thing from all the mirrors where I connect... > > How can I obtain the new Win32 release ? > > Luc > > ----- Original Message ----- From: "Neil Conway" <neilc@samurai.com> > To: "Marc G. Fournier" <scrappy@postgresql.org> > Cc: <pgsql-announce@postgresql.org>; <pgsql-general@postgresql.org> > Sent: Wednesday, May 11, 2005 2:39 AM > Subject: Re: [ANNOUNCE] [GENERAL] SECURITY RELEASES: 7.2.8 - 7.3.10 - > 7.4.8 - 8.0.3 > > >> Marc G. Fournier wrote: >> >>> Please note that the security issues were those already reported by >>> Tom Lane, as well as a manual fix for them. These releases are >>> mainly to ensure that those installing and/or upgrading existing >>> installations have those fixes automatically. >> >> >> Note that if you're upgrading within a release series (e.g. 8.0.x to >> 8.0.3) without a dump and reload, you will _not_ get the necessary >> system catalog changes automatically. Tom's earlier mail describes the >> procedure needed to correct the system catalog: >> >> http://www.postgresql.org/about/news.315 >> >> -Neil >> >> ---------------------------(end of broadcast)--------------------------- >> TIP 6: Have you searched our list archives? >> >> http://archives.postgresql.org >> > > > ---------------------------(end of broadcast)--------------------------- > TIP 2: you can get off all lists at once with the unregister command > (send "unregister YourEmailAddressHere" to majordomo@postgresql.org) -- Aly Dharshi aly.dharshi@telus.net "A good speech is like a good dress that's short enough to be interesting and long enough to cover the subject"