PostgreSQL 12.4, 11.9, 10.14, 9.6.19, 9.5.23
Security Issues
CVE-2020-14349: Uncontrolled search path element in logical replication.
Versions Affected: 10 - 12.
The PostgreSQL search_path setting determines schemas searched for tables, functions, operators, etc. The CVE-2018-1058 fix caused most PostgreSQL-provided client applications to sanitize search_path, but logical replication continued to leave search_path unchanged. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser. Installations having adopted a documented secure schema usage pattern are not vulnerable.
The PostgreSQL project thanks Noah Misch for reporting this problem.
CVE-2020-14350: Uncontrolled search path element in CREATE EXTENSION.
Versions Affected: 9.5 - 12. The security team typically does not test unsupported versions, but this problem is quite old.
When a superuser runs certain CREATE EXTENSION statements, users may be able to execute arbitrary SQL functions under the identity of that superuser. The attacker must have permission to create objects in the new extension's schema or a schema of a prerequisite extension. Not all extensions are vulnerable.
In addition to correcting the extensions provided with PostgreSQL, the PostgreSQL Global Development Group is issuing guidance for third-party extension authors to secure their own work.
Bug Fixes and Improvements
This update also fixes over 50 bugs that were reported in the last several months. Some of these issues affect only version 12, but many affect all supported versions.
Some of these fixes include:
Fix edge cases in partition pruning involving multiple partition key columns with multiple or no constraining WHERE clauses.
Several fixes for query planning and execution involving partitions.
Fix for determining when to execute a column-specific UPDATE trigger on a logical replication subscriber.
pg_replication_slot_advance() now updates the oldest xmin and LSN values, as the failure to do this could prevent resources (e.g. WAL files) from being cleaned up.
Fix a performance regression in ts_headline().
Ensure that pg_read_file() and related functions read until EOF is reached, which fixes compatibility with pipes and other virtual files.
Forbid numeric NaN values in jsonpath computations, which do not exist in SQL nor JSON.
Several fixes for NaN inputs with aggregate functions. This fixes a change in PostgreSQL 12 where NaN values caused the following aggregates to emit values of 0 instead of NaN: corr(), covar_pop(), regr_intercept(), regr_r2(), regr_slope(), regr_sxx(), regr_sxy(), regr_syy(), stddev_pop(), and var_pop().
time and timetz values fractionally greater than 24:00:00 are now rejected.
Several fixes for EXPLAIN, including a fix for reporting resource usage when a plan uses parallel workers with "Gather Merge" nodes.
Fix timing of constraint revalidation in ALTER TABLE that could lead to odd errors.
Fix for REINDEX CONCURRENTLY that could prevent old values from being included in future logical decoding output.
Fix for LATERAL references that could potentially cause crashes during query execution.
Use the collation specified for a query when estimating operator costs
Fix conflict-checking anomalies in SERIALIZABLE transaction isolation mode.
Ensure checkpointer process discards file sync requests when fsync is off
Fix issue where pg_control could be written out with an inconsistent checksum, which could lead to the inability to restart the database if it crashed before the next pg_control update.
Ensure that libpq continues to try to read from the database connection socket after a write failure, as this allows the connection to collect any final error messages from the server.
Report out-of-disk-space errors properly in pg_dump and pg_basebackup
Several fixes for pg_restore, including a fix for parallel restore on tables that have both table-level and column-level privileges.
Fix for pg_upgrade to ensure it runs with vacuum_defer_cleanup_age set to 0.
Fix how pg_rewind handles just-deleted files in the source data directory
Fix failure to initialize local state correctly in contrib/dblink, which could lead to dblink_close() issuing an unexpected COMMIT on the remote server.
Change contrib/amcheck to not report about deleted index pages that are empty, as this is normal during WAL replay.
cbe1d0d39e