Fwd: [ANNOUNCE] PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

Heiko W.Rupp hrupp at redhat.com
Thu Apr 4 13:35:30 UTC 2013



FYI for all users using PostgreSQL as database

Anfang der weitergeleiteten E-Mail:

> Von: Dave Page <dpage at postgresql.org>
> Betreff: [ANNOUNCE] PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
> Datum: 4. April 2013 15:29:55 MESZ
> An: pgsql-announce <pgsql-announce at postgresql.org>
> 
> The PostgreSQL Global Development Group has released a security update to all
> current versions of the PostgreSQL database system, including versions 9.2.4,
> 9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security
> vulnerability in versions 9.0 and later. All users of the affected versions
> are strongly urged to apply the update *immediately*.
> 
> A major security issue fixed in this release, CVE-2013-1899
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899), makes it
> possible for a connection request containing a database name that begins
> with "-" to be crafted that can damage or destroy files within a server's
> data directory. Anyone with access to the port the PostgreSQL server listens
> on can initiate this request. This issue was discovered by Mitsumasa Kondo
> and Kyotaro Horiguchi of NTT Open Source Software Center.
> 
> Two lesser security fixes are also included in this release: CVE-2013-1900
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900), wherein random
> numbers generated by contrib/pgcrypto functions may be easy for another
> database user to guess, and CVE-2013-1901
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901), which
> mistakenly allows an unprivileged user to run commands that could interfere
> with in-progress backups. Finally, this release fixes two security issues
> with the graphical installers for Linux and Mac OS X: insecure passing of
> superuser passwords to a script, CVE-2013-1903
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1903) and the use of
> predictable filenames in /tmp CVE-2013-1902
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1902). Marko Kreen,
> Noah Misch and Stefan Kaltenbrunner reported these issues, respectively.
> 
> We are grateful for each developer's efforts in making PostgreSQL more secure.
> 
> This release also corrects several errors in management of GiST indexes. After
> installing this update, it is advisable to REINDEX any GiST indexes that meet
>  one or more of the conditions described below.
> 
> This update release also contains fixes for many minor issues discovered and
> patched by the PostgreSQL community in the last two months, including:
> 
> * Fix GiST indexes to not use "fuzzy" geometric comparisons for box, polygon,
>  circle, and point columns
> * Fix bugs in contrib/btree_gist for GiST indexes on text, bytea, bit, and
>  numeric columns
> * Fix bugs in page splitting code for multi-column GiST indexes
> * Fix buffer leak in WAL replay causing "incorrect local pin count" errors
> * Ensure crash recovery before entering archive recovery during unclean
>  shutdown when recovery.conf is present
> * Avoid deleting not-yet-archived WAL files during crash recovery
> * Fix race condition in DELETE RETURNING
> * Fix possible planner crash after adding columns to a view depending on
>  another view
> * Eliminate memory leaks in PL/Perl's spi_prepare() function
> * Fix pg_dumpall to handle database names containing "=" correctly
> * Avoid crash in pg_dump when an incorrect connection string is given
> * Ignore invalid indexes in pg_dump and pg_upgrade
> * Include only the current server version's subdirectory when backing up a
>  tablespace with pg_basebackup
> * Add a server version check in pg_basebackup and pg_receivexlog
> * Fix contrib/dblink to handle inconsistent settings of DateStyle or
>  IntervalStyle safely
> * Fix contrib/pg_trgm's similarity() function to return zero for trigram-less
>  strings
> * Enable building PostgreSQL with Microsoft Visual Studio 2012
> * Update time zone data files for DST law changes in Chile, Haiti, Morocco,
>  Paraguay, and some Russian areas
> 
> As always, update releases only require installation of packages and a
> database system restart. You do not need to dump/restore or use pg_upgrade
> for this update release.  Users who have skipped multiple update releases may
> need to perform additional, post-update steps; see the Release Notes for
> details.
> 
> Links:
> 
> * Download: http://postgresql.org/download
> * Release Notes: http://www.postgresql.org/docs/current/static/release.html
> * Release FAQ: http://www.postgresql.org/support/security/faq/2013-04-04/
> 
> --
> Dave Page
> PostgreSQL Core Team
> http://www.postgresql.org/
> 
> 
> -- 
> Sent via pgsql-announce mailing list (pgsql-announce at postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-announce

-- 
Reg. Adresse: Red Hat GmbH, Technopark II, Haus C, 
Werner-von-Siemens-Ring 14, D-85630 Grasbrunn
Handelsregister: Amtsgericht München HRB 153243
Geschaeftsführer:  Mark Hegarty, Charlie Peters, Michael Cunningham, Charles Cachera

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 203 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://lists.fedorahosted.org/pipermail/rhq-devel/attachments/20130404/27b9a22d/attachment.sig>


More information about the rhq-devel mailing list