The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 10.1, 9.6.6, 9.5.10, 9.4.15, 9.3.20, and 9.2.24. This release fixes three security issues. This release also fixes issues found in BRIN indexing, logical replication and other bugs reported over the past three months.
All users using the affected versions of PostgreSQL should update as soon as possible. If you use BRIN indexes or contrib/start-scripts, please see the release notes for additional post-upgrade steps.
Security Issues
Three security vulnerabilities have been fixed by this release:
CVE-2017-12172: Start scripts permit database administrator to modify root-owned files
CVE-2017-15098: Memory disclosure in JSON functions
CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges
Bug Fixes and Improvements
This update also fixes a number of bugs reported in the last few months. Some of these issues affect only version 10, but many affect all supported versions:
Fix a race condition in BRIN indexing that could cause some rows to not be included in the indexing.
Fix crash when logical decoding is invoked from a PL language function.
Several fixes for logical replication.
Restored behavior for CTEs attached to INSERT/UPDATE/DELETE statements to pre-version 10.
Prevent low-probability crash in processing of nested trigger firings.
Do not evaluate an aggregate function's argument expressions when the conditions in the FILTER clause evaluate to FALSE. This complies with SQL-standard behavior.
Fix incorrect query results when multiple GROUPING SETS columns contain the same simple variable.
Fix memory leak over the lifespan of a query when evaluating a set-returning function from the target list in a SELECT.
Several fixes for parallel query execution, including fixing a crash in the parallel execution of certain queries that contain a certain type of bitmap scan.
Fix json_build_array(), json_build_object(), jsonb_build_array(), and jsonb_build_object() to handle explicit VARIADIC arguments correctly.
Prevent infinite float values from being casted to the numeric type.
Fix autovacuum's “work item” logic to prevent possible crashes and silent loss of work items.
Several fixes for VIEWs around adding columns to the end of a view.
Fix for hashability detection of range data types that are created by a user.
Improvements on using extended statistics on columns for the purposes of query planning.
Prevent idle_in_transaction_session_timeout from being ignored when a statement_timeout occurred earlier.
Fix low-probability loss of NOTIFY messages due more than 2 billion transactions processing before any queries are executed in the session.
Several file system interaction fixes.
Correctly restore the umask setting when file creation fails in COPY or lo_export().
Fix pg_dump to ensure that it emits GRANT commands in a valid order.
Fix pg_basebackup's matching of tablespace paths to canonicalize both paths before comparing to help improve Windows compatibility.
Fix libpq to not require user's home directory to exist when trying to read the "~/.pgpass" file.
Several fixes for ecpg.
This release includes fixes that prevent a crash in pg_restore when using parallel mode. It also patches over a few other bugs reported since the last releases in August.
Additionally, in 9.4.14 only, there is a fix to an issue with walsenders preventing primary-server shutdown unless immediate shutdown mode is used.
Users should plan to update at the next convenient downtime.
Three security vulnerabilities have been closed by this release:
* CVE-2017-7546: Empty password accepted in some authentication methods
* CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords to users lacking server privileges
* CVE-2017-7548: lo_put() function ignores ACLs
Security Issues
---------------
Two security holes have been closed by this release:
CVE-2016-5423: certain nested CASE expressions can cause the server to crash.
CVE-2016-5424: database and role names with embedded special characters can allow code injection during administrative operations like pg_dumpall.
The fix for the second issue also adds an option, -reuse-previous, to psql's \connect command. pg_dumpall will also refuse to handle database and role names containing line breaks after the update. For more information on these issues and how they affect backwards-compatibility, see the Release Notes.
Bug Fixes and Improvements
--------------------------
This update also fixes a number of bugs reported in the last few months. Some of these issues affect only version 9.5, but many affect all supported versions:
Fix misbehaviors of IS NULL/IS NOT NULL with composite values
Fix three areas where INSERT ... ON CONFLICT failed to work properly with other SQL features.
Make INET and CIDR data types properly reject bad IPv6 values
Prevent crash in "point ## lseg" operator for NaN input
Avoid possible crash in pg_get_expr()
Fix several one-byte buffer over-reads in to_number()
Don't needlessly plan query if WITH NO DATA is specified
Avoid crash-unsafe state in expensive heap_update() paths
Fix hint bit update during WAL replay of row locking operations
Avoid unnecessary "could not serialize access" with FOR KEY SHARE
Avoid crash in postgres -C when the specified variable is a null string
Fix two issues with logical decoding and subtransactions
Ensure that backends see up-to-date statistics for shared catalogs
Prevent possible failure when vacuuming multixact IDs in an upgraded database
When a manual ANALYZE specifies columns, don't reset changes_since_analyze
Fix ANALYZE's overestimation of n_distinct for columns with nulls
Fix bug in b-tree mark/restore processing
Fix building of large (bigger than shared_buffers) hash indexes
Prevent infinite loop in GiST index build with NaN values
Fix possible crash during a nearest-neighbor indexscan
Fix "PANIC: failed to add BRIN tuple" error
Prevent possible crash during background worker shutdown
Many fixes for issues in parallel pg_dump and pg_restore
Make pg_basebackup accept -Z 0 as no compression
Make regression tests safe for Danish and Welsh locales
previous handful of packages like -datatypes or -dblink. They
contain all of the contrib subtree, matching what similar packages
carry in e.g. FreeBSD ports or what PostgreSQL users generally
expect.
This subtree contains porting tools, analysis utilities, and
plug-in features that are not part of the core PostgreSQL system,
mainly because they address a limited audience or are too
experimental to be part of the main source tree. This does not
preclude their usefulness.
This release closes security hole CVE-2016-2193, where a query plan might get reused for more than one ROLE in the same session. This could cause the wrong set of Row Level Security (RLS) policies to be used for the query.
The update also fixes CVE-2016-3065, a server crash bug triggered by using pageinspect with BRIN index pages. Since an attacker might be able to expose a few bytes of server memory, this crash is being treated as a security issue.
Heads up: For upgrading past 9.4.5, users of jsonb_path_ops GIN indexes
should perform a REINDEX, because of a hash calculation fix.
This release fixes two security issues, as well as several bugs found
over the last four months.
CVE-2016-0773 Unicode regular expression buffer overflow
CVE-2016-0766 PL/Java privilege escalation
Problems found with existing distfiles:
distfiles/D6.data.ros.gz
distfiles/cstore0.2.tar.gz
distfiles/data4.tar.gz
distfiles/sphinx-2.2.7-release.tar.gz
No changes made to the cstore or mariadb55-client distinfo files.
Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden). All existing
SHA1 digests retained for now as an audit trail.
Two security issues have been fixed in this release which affect users of specific PostgreSQL features:
CVE-2015-5289: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service.
CVE-2015-5288: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed.
This release primarily fixes issues not successfully fixed in prior releases. It should be applied as soon as possible all users of major versions 9.3 and 9.4. Other users should apply at the next available downtime.
Crash Recovery Fixes:
Earlier update releases attempted to fix an issue in PostgreSQL 9.3 and 9.4 with "multixact wraparound", but failed to account for issues doing multixact cleanup during crash recovery. This could cause servers to be unable to restart after a crash. As such, all users of 9.3 and 9.4 should apply this update as soon as possible.
* File Permissions Fix
* Have pg_get_functiondef() show the LEAKPROOF property
* Make pushJsonbValue() function push jbvBinary type
* Allow building with threaded Python on OpenBSD
Security Fixes
* CVE-2015-0241 Buffer overruns in "to_char" functions.
* CVE-2015-0242 Buffer overrun in replacement printf family of functions.
* CVE-2015-0243 Memory errors in functions in the pgcrypto extension.
* CVE-2015-0244 An error in extended protocol message reading.
* CVE-2014-8161 Constraint violation errors can cause display of values in columns which the user would not normally have rights to see.
JSON and JSONB Unicode Escapes
Other Fixes and Improvements
* Cope with the non-ASCII Norwegian Windows locale name.
* Avoid data corruption when databases are moved to new tablespaces and back again.
* Ensure that UNLOGGED tables are correctly copied during ALTER DATABASE operations.
* Avoid deadlocks when locking recently modified rows.
* Fix two SELECT FOR UPDATE query issues.
* Prevent false negative for shortest-first regular expression matches.
* Fix false positives and negatives in tsquery contains operator.
* Fix namespace handling in xpath().
* Prevent row-producing functions from creating empty column names.
* Make autovacuum use per-table cost_limit and cost_delay settings.
* When autovacuum=off, limit autovacuum work to wraparound prevention only.
* Multiple fixes for logical decoding in 9.4.
* Fix transient errors on hot standby queries due to page replacement.
* Prevent duplicate WAL file archiving at end of recovery or standby promotion.
* Prevent deadlock in parallel restore of schema-only dump.
This release adds many new features which enhance PostgreSQL's flexibility, scalability and performance for many different types of database users, including improvements to JSON support, replication and index performance.
