postgres.git / summary / log / commit / refs
commit 9d4e01ca3ef847748b96bdc69f88b7368ca95811
Author: Tom Lane <tgl@sss.pgh.pa.us>
Date: Thu May 13 21:27:08 2010 +0000
First released in: 9.0.0, 7.4.29, 8.0.25, 8.1.21, 8.2.17, 8.3.11, 8.4.4
Update release notes with security issues.
Security: CVE-2010-1169, CVE-2010-1170
doc/src/sgml/release-7.4.sgml | 42 ++++++++++++++++++++++++++++++++++++++-
doc/src/sgml/release-8.0.sgml | 42 ++++++++++++++++++++++++++++++++++++++-
doc/src/sgml/release-8.1.sgml | 42 ++++++++++++++++++++++++++++++++++++++-
doc/src/sgml/release-8.2.sgml | 42 ++++++++++++++++++++++++++++++++++++++-
doc/src/sgml/release-8.3.sgml | 42 ++++++++++++++++++++++++++++++++++++++-
doc/src/sgml/release-8.4.sgml | 46 ++++++++++++++++++++++++++++++++++++++++---
6 files changed, 248 insertions(+), 8 deletions(-)
diff --git a/doc/src/sgml/release-7.4.sgml b/doc/src/sgml/release-7.4.sgml
index d9fbc00bac3..1b7f1109e5f 100644
--- a/doc/src/sgml/release-7.4.sgml
+++ b/doc/src/sgml/release-7.4.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release-7.4.sgml,v 1.1.12.5 2010/05/12 23:27:25 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release-7.4.sgml,v 1.1.12.6 2010/05/13 21:27:07 tgl Exp $ -->
<!-- See header comment in release.sgml about typical markup -->
<sect1 id="release-7-4-29">
@@ -37,6 +37,46 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Enforce restrictions in <literal>plperl</> using an opmask applied to
+ the whole interpreter, instead of using <filename>Safe.pm</>
+ (Tim Bunce, Andrew Dunstan)
+ </para>
+
+ <para>
+ Recent developments have convinced us that <filename>Safe.pm</> is too
+ insecure to rely on for making <literal>plperl</> trustable. This
+ change removes use of <filename>Safe.pm</> altogether, in favor of using
+ a separate interpreter with an opcode mask that is always applied.
+ Pleasant side effects of the change include that it is now possible to
+ use Perl's <literal>strict</> pragma in a natural way in
+ <literal>plperl</>, and that Perl's <literal>$a</> and <literal>$b</>
+ variables work as expected in sort routines, and that function
+ compilation is significantly faster. (CVE-2010-1169)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Prevent PL/Tcl from executing untrustworthy code from
+ <structname>pltcl_modules</> (Tom)
+ </para>
+
+ <para>
+ PL/Tcl's feature for autoloading Tcl code from a database table
+ could be exploited for trojan-horse attacks, because there was no
+ restriction on who could create or insert into that table. This change
+ disables the feature unless <structname>pltcl_modules</> is owned by a
+ superuser. (However, the permissions on the table are not checked, so
+ installations that really need a less-than-secure modules table can
+ still grant suitable privileges to trusted non-superusers.) Also,
+ prevent loading code into the unrestricted <quote>normal</> Tcl
+ interpreter unless we are really going to execute a <literal>pltclu</>
+ function. (CVE-2010-1170)
+ </para>
+ </listitem>
+
<listitem>
<para>
Do not allow an unprivileged user to reset superuser-only parameter
diff --git a/doc/src/sgml/release-8.0.sgml b/doc/src/sgml/release-8.0.sgml
index 66429ca8124..c2670298b0f 100644
--- a/doc/src/sgml/release-8.0.sgml
+++ b/doc/src/sgml/release-8.0.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.0.sgml,v 1.1.10.5 2010/05/12 23:27:25 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.0.sgml,v 1.1.10.6 2010/05/13 21:27:07 tgl Exp $ -->
<!-- See header comment in release.sgml about typical markup -->
<sect1 id="release-8-0-25">
@@ -37,6 +37,46 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Enforce restrictions in <literal>plperl</> using an opmask applied to
+ the whole interpreter, instead of using <filename>Safe.pm</>
+ (Tim Bunce, Andrew Dunstan)
+ </para>
+
+ <para>
+ Recent developments have convinced us that <filename>Safe.pm</> is too
+ insecure to rely on for making <literal>plperl</> trustable. This
+ change removes use of <filename>Safe.pm</> altogether, in favor of using
+ a separate interpreter with an opcode mask that is always applied.
+ Pleasant side effects of the change include that it is now possible to
+ use Perl's <literal>strict</> pragma in a natural way in
+ <literal>plperl</>, and that Perl's <literal>$a</> and <literal>$b</>
+ variables work as expected in sort routines, and that function
+ compilation is significantly faster. (CVE-2010-1169)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Prevent PL/Tcl from executing untrustworthy code from
+ <structname>pltcl_modules</> (Tom)
+ </para>
+
+ <para>
+ PL/Tcl's feature for autoloading Tcl code from a database table
+ could be exploited for trojan-horse attacks, because there was no
+ restriction on who could create or insert into that table. This change
+ disables the feature unless <structname>pltcl_modules</> is owned by a
+ superuser. (However, the permissions on the table are not checked, so
+ installations that really need a less-than-secure modules table can
+ still grant suitable privileges to trusted non-superusers.) Also,
+ prevent loading code into the unrestricted <quote>normal</> Tcl
+ interpreter unless we are really going to execute a <literal>pltclu</>
+ function. (CVE-2010-1170)
+ </para>
+ </listitem>
+
<listitem>
<para>
Do not allow an unprivileged user to reset superuser-only parameter
diff --git a/doc/src/sgml/release-8.1.sgml b/doc/src/sgml/release-8.1.sgml
index 7c46499284e..46553795161 100644
--- a/doc/src/sgml/release-8.1.sgml
+++ b/doc/src/sgml/release-8.1.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.1.sgml,v 1.1.8.5 2010/05/12 23:27:25 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.1.sgml,v 1.1.8.6 2010/05/13 21:27:07 tgl Exp $ -->
<!-- See header comment in release.sgml about typical markup -->
<sect1 id="release-8-1-21">
@@ -31,6 +31,46 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Enforce restrictions in <literal>plperl</> using an opmask applied to
+ the whole interpreter, instead of using <filename>Safe.pm</>
+ (Tim Bunce, Andrew Dunstan)
+ </para>
+
+ <para>
+ Recent developments have convinced us that <filename>Safe.pm</> is too
+ insecure to rely on for making <literal>plperl</> trustable. This
+ change removes use of <filename>Safe.pm</> altogether, in favor of using
+ a separate interpreter with an opcode mask that is always applied.
+ Pleasant side effects of the change include that it is now possible to
+ use Perl's <literal>strict</> pragma in a natural way in
+ <literal>plperl</>, and that Perl's <literal>$a</> and <literal>$b</>
+ variables work as expected in sort routines, and that function
+ compilation is significantly faster. (CVE-2010-1169)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Prevent PL/Tcl from executing untrustworthy code from
+ <structname>pltcl_modules</> (Tom)
+ </para>
+
+ <para>
+ PL/Tcl's feature for autoloading Tcl code from a database table
+ could be exploited for trojan-horse attacks, because there was no
+ restriction on who could create or insert into that table. This change
+ disables the feature unless <structname>pltcl_modules</> is owned by a
+ superuser. (However, the permissions on the table are not checked, so
+ installations that really need a less-than-secure modules table can
+ still grant suitable privileges to trusted non-superusers.) Also,
+ prevent loading code into the unrestricted <quote>normal</> Tcl
+ interpreter unless we are really going to execute a <literal>pltclu</>
+ function. (CVE-2010-1170)
+ </para>
+ </listitem>
+
<listitem>
<para>
Do not allow an unprivileged user to reset superuser-only parameter
diff --git a/doc/src/sgml/release-8.2.sgml b/doc/src/sgml/release-8.2.sgml
index 203b3ba60c8..0869e49f4f9 100644
--- a/doc/src/sgml/release-8.2.sgml
+++ b/doc/src/sgml/release-8.2.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.2.sgml,v 1.1.6.5 2010/05/12 23:27:25 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.2.sgml,v 1.1.6.6 2010/05/13 21:27:07 tgl Exp $ -->
<!-- See header comment in release.sgml about typical markup -->
<sect1 id="release-8-2-17">
@@ -31,6 +31,46 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Enforce restrictions in <literal>plperl</> using an opmask applied to
+ the whole interpreter, instead of using <filename>Safe.pm</>
+ (Tim Bunce, Andrew Dunstan)
+ </para>
+
+ <para>
+ Recent developments have convinced us that <filename>Safe.pm</> is too
+ insecure to rely on for making <literal>plperl</> trustable. This
+ change removes use of <filename>Safe.pm</> altogether, in favor of using
+ a separate interpreter with an opcode mask that is always applied.
+ Pleasant side effects of the change include that it is now possible to
+ use Perl's <literal>strict</> pragma in a natural way in
+ <literal>plperl</>, and that Perl's <literal>$a</> and <literal>$b</>
+ variables work as expected in sort routines, and that function
+ compilation is significantly faster. (CVE-2010-1169)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Prevent PL/Tcl from executing untrustworthy code from
+ <structname>pltcl_modules</> (Tom)
+ </para>
+
+ <para>
+ PL/Tcl's feature for autoloading Tcl code from a database table
+ could be exploited for trojan-horse attacks, because there was no
+ restriction on who could create or insert into that table. This change
+ disables the feature unless <structname>pltcl_modules</> is owned by a
+ superuser. (However, the permissions on the table are not checked, so
+ installations that really need a less-than-secure modules table can
+ still grant suitable privileges to trusted non-superusers.) Also,
+ prevent loading code into the unrestricted <quote>normal</> Tcl
+ interpreter unless we are really going to execute a <literal>pltclu</>
+ function. (CVE-2010-1170)
+ </para>
+ </listitem>
+
<listitem>
<para>
Fix possible crash if a cache reset message is received during
diff --git a/doc/src/sgml/release-8.3.sgml b/doc/src/sgml/release-8.3.sgml
index 21cea166c18..4f7f60767f6 100644
--- a/doc/src/sgml/release-8.3.sgml
+++ b/doc/src/sgml/release-8.3.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.3.sgml,v 1.1.4.5 2010/05/12 23:27:26 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.3.sgml,v 1.1.4.6 2010/05/13 21:27:08 tgl Exp $ -->
<!-- See header comment in release.sgml about typical markup -->
<sect1 id="release-8-3-11">
@@ -31,6 +31,46 @@
<itemizedlist>
+ <listitem>
+ <para>
+ Enforce restrictions in <literal>plperl</> using an opmask applied to
+ the whole interpreter, instead of using <filename>Safe.pm</>
+ (Tim Bunce, Andrew Dunstan)
+ </para>
+
+ <para>
+ Recent developments have convinced us that <filename>Safe.pm</> is too
+ insecure to rely on for making <literal>plperl</> trustable. This
+ change removes use of <filename>Safe.pm</> altogether, in favor of using
+ a separate interpreter with an opcode mask that is always applied.
+ Pleasant side effects of the change include that it is now possible to
+ use Perl's <literal>strict</> pragma in a natural way in
+ <literal>plperl</>, and that Perl's <literal>$a</> and <literal>$b</>
+ variables work as expected in sort routines, and that function
+ compilation is significantly faster. (CVE-2010-1169)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Prevent PL/Tcl from executing untrustworthy code from
+ <structname>pltcl_modules</> (Tom)
+ </para>
+
+ <para>
+ PL/Tcl's feature for autoloading Tcl code from a database table
+ could be exploited for trojan-horse attacks, because there was no
+ restriction on who could create or insert into that table. This change
+ disables the feature unless <structname>pltcl_modules</> is owned by a
+ superuser. (However, the permissions on the table are not checked, so
+ installations that really need a less-than-secure modules table can
+ still grant suitable privileges to trusted non-superusers.) Also,
+ prevent loading code into the unrestricted <quote>normal</> Tcl
+ interpreter unless we are really going to execute a <literal>pltclu</>
+ function. (CVE-2010-1170)
+ </para>
+ </listitem>
+
<listitem>
<para>
Fix possible crash if a cache reset message is received during
diff --git a/doc/src/sgml/release-8.4.sgml b/doc/src/sgml/release-8.4.sgml
index f8e03149fa5..4ff2e1ca1d3 100644
--- a/doc/src/sgml/release-8.4.sgml
+++ b/doc/src/sgml/release-8.4.sgml
@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.4.sgml,v 1.12.2.6 2010/05/12 23:27:26 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release-8.4.sgml,v 1.12.2.7 2010/05/13 21:27:08 tgl Exp $ -->
<!-- See header comment in release.sgml about typical markup -->
<sect1 id="release-8-4-4">
@@ -33,8 +33,48 @@
<listitem>
<para>
- Fix error during WAL replay of <literal>ALTER ... SET TABLESPACE</>
- (Tom)
+ Enforce restrictions in <literal>plperl</> using an opmask applied to
+ the whole interpreter, instead of using <filename>Safe.pm</>
+ (Tim Bunce, Andrew Dunstan)
+ </para>
+
+ <para>
+ Recent developments have convinced us that <filename>Safe.pm</> is too
+ insecure to rely on for making <literal>plperl</> trustable. This
+ change removes use of <filename>Safe.pm</> altogether, in favor of using
+ a separate interpreter with an opcode mask that is always applied.
+ Pleasant side effects of the change include that it is now possible to
+ use Perl's <literal>strict</> pragma in a natural way in
+ <literal>plperl</>, and that Perl's <literal>$a</> and <literal>$b</>
+ variables work as expected in sort routines, and that function
+ compilation is significantly faster. (CVE-2010-1169)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Prevent PL/Tcl from executing untrustworthy code from
+ <structname>pltcl_modules</> (Tom)
+ </para>
+
+ <para>
+ PL/Tcl's feature for autoloading Tcl code from a database table
+ could be exploited for trojan-horse attacks, because there was no
+ restriction on who could create or insert into that table. This change
+ disables the feature unless <structname>pltcl_modules</> is owned by a
+ superuser. (However, the permissions on the table are not checked, so
+ installations that really need a less-than-secure modules table can
+ still grant suitable privileges to trusted non-superusers.) Also,
+ prevent loading code into the unrestricted <quote>normal</> Tcl
+ interpreter unless we are really going to execute a <literal>pltclu</>
+ function. (CVE-2010-1170)
+ </para>
+ </listitem>
+
+ <listitem>
+ <para>
+ Fix data corruption during WAL replay of
+ <literal>ALTER ... SET TABLESPACE</> (Tom)
</para>
<para>
[parent: 0554358756d0]