public inbox for [email protected]
help / color / mirror / Atom feed[Pljava-dev] PL/Java 1.5.0-BETA1 announced; security note.
2+ messages / 2 participants
[nested] [flat]
* [Pljava-dev] PL/Java 1.5.0-BETA1 announced; security note.
@ 2016-02-01 04:54 Chapman Flack <[email protected]>
0 siblings, 1 reply; 2+ messages in thread
From: Chapman Flack @ 2016-02-01 04:54 UTC (permalink / raw)
PL/Java brings functions, triggers, and types in Java. 1.5.0, now
in beta, supports latest PostgreSQL and Java versions with a range
of improvements and fixes.
Project site: http://tada.github.io/pljava/
Release notes: http://tada.github.io/pljava/releasenotes.html
Security note:
1.5.0 brings a policy change to a more secure-by-default posture, where
the ability to create functions in 'LANGUAGE java' is no longer
automatically granted to 'public', but can be selectively granted to
roles that will have that responsibility. The change reduces exposure to
a known issue present in 1.5.0 and earlier versions, that will be closed
in a future release; details are in the release notes.
The new policy will be applied in a new installation; permissions will
not be changed in an upgrade, but any site can move to this policy, even
before updating to 1.5.0, with REVOKE USAGE ON LANGUAGE java FROM
public; followed by explicit GRANT commands for the users/roles expected
to create Java functions. Many sites guided by the principle of least
privilege may have chosen such a policy already.
MS Windows note:
1.5.0 development snapshots have been repeatedly tested on Windows
building with Visual Studio (including the Express and Community
editions), and the build documentation covers this combination.
Beta testers should find it straightforward.
Resources have not been available to test MinGW-based builds.
Beta testers using this combination are encouraged to report
build issues they may encounter. (Patches, where possible, would
be appreciated also. A likely place to look in case of issues
would be the comments above PLJAVADLLEXPORT in Backend.c.)
Many thanks to all the individuals and organizations listed
in the release notes under Credits.
--
Chapman Flack
_______________________________________________
Pljava-dev mailing list
[email protected]
http://lists.pgfoundry.org/mailman/listinfo/pljava-dev
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: [Pljava-dev] PL/Java 1.5.0-BETA1 announced; security note.
@ 2016-02-01 20:46 John R Pierce <[email protected]>
parent: Chapman Flack <[email protected]>
0 siblings, 0 replies; 2+ messages in thread
From: John R Pierce @ 2016-02-01 20:46 UTC (permalink / raw)
On 1/31/2016 8:54 PM, Chapman Flack wrote:
> PL/Java brings functions, triggers, and types in Java. 1.5.0, now
> in beta, supports latest PostgreSQL and Java versions with a range
> of improvements and fixes.
so I see you've started a 1.6.0_snapshot... any plans for that, or
is that just a placeholder for now for future work?
--
john r pierce, recycling bits in santa cruz
_______________________________________________
Pljava-dev mailing list
[email protected]
http://lists.pgfoundry.org/mailman/listinfo/pljava-dev
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2016-02-01 20:46 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2016-02-01 04:54 [Pljava-dev] PL/Java 1.5.0-BETA1 announced; security note. Chapman Flack <[email protected]>
2016-02-01 20:46 ` John R Pierce <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox