SECURITY RELEASES: 7.2.8 - 7.3.10 - 7.4.8 - 8.0.3

In order to address several security issues identified over the past two
weeks, as well as one "low probability" race condition, we are releasing
new version of PostgreSQL as far back as the 7.2.x branch.

Please note that the security issues were those already reported by Tom
Lane, as well as a manual fix for them. These releases are mainly to
ensure that those installing and/or upgrading existing installations have
those fixes automatically.

For details on the fixes, please see the HISTORY file included in the
Release, but a summary consists of:

* Change encoding function signature to prevent misuse
* Change "contrib/tsearch2" to avoid unsafe use of INTERNAL function
results
* Repair race condition between relation extension and VACUUM
This could theoretically have caused loss of a page's worth of
freshly-inserted data, although the scenario seems of very low
probability. There are no known cases of it having caused more than
an Assert failure.

Downloads are available via:

http://www.postgresql.org/download

Please report any bugs to:

pgsql-bugs(at)postgresql(dot)org

----
Marc G. Fournier Hub.Org Networking Services (http://www.hub.org)
Email: scrappy(at)hub(dot)org Yahoo!: yscrappy ICQ: 7615664

Marc G. Fournier wrote:
> Please note that the security issues were those already reported by Tom
> Lane, as well as a manual fix for them. These releases are mainly to
> ensure that those installing and/or upgrading existing installations
> have those fixes automatically.

Note that if you're upgrading within a release series (e.g. 8.0.x to
8.0.3) without a dump and reload, you will _not_ get the necessary
system catalog changes automatically. Tom's earlier mail describes the
procedure needed to correct the system catalog:

http://www.postgresql.org/about/news.315

-Neil

Neil Conway <neilc(at)samurai(dot)com> writes:
> Note that if you're upgrading within a release series (e.g. 8.0.x to
> 8.0.3) without a dump and reload, you will _not_ get the necessary
> system catalog changes automatically. Tom's earlier mail describes the
> procedure needed to correct the system catalog:

> http://www.postgresql.org/about/news.315

Also, note that that message was the zero-day-security-problem response
to the issue, and that we since figured out cleaner responses. If you
haven't yet implemented this in your own DBs, I would suggest following
the procedures given in the final release notes, eg
http://developer.postgresql.org/docs/postgres/release-7-4-8.html

I expect these notes will shortly show up in the static documentation, eg
http://www.postgresql.org/docs/7.4/static/release.html
but they aren't there yet as I set finger to keyboard.

regards, tom lane

Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> writes:

> Neil Conway <neilc(at)samurai(dot)com> writes:

>> http://www.postgresql.org/about/news.315
>
> Also, note that that message was the zero-day-security-problem response
> to the issue, and that we since figured out cleaner responses. If you
> haven't yet implemented this in your own DBs, I would suggest following
> the procedures given in the final release notes, eg
> http://developer.postgresql.org/docs/postgres/release-7-4-8.html

If we've already done the zero-day fix, is there any value in re-doing
it the "cleaner" way?

-Doug

Douglas McNaught <doug(at)mcnaught(dot)org> writes:
> Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> writes:
>> Also, note that that message was the zero-day-security-problem response
>> to the issue, and that we since figured out cleaner responses. If you
>> haven't yet implemented this in your own DBs, I would suggest following
>> the procedures given in the final release notes, eg
>> http://developer.postgresql.org/docs/postgres/release-7-4-8.html

> If we've already done the zero-day fix, is there any value in re-doing
> it the "cleaner" way?

Only if you care about allowing unprivileged users to create conversions
(which seems a bit useless to me, but it's in the regression tests...)

regards, tom lane

I've updated my Perl script to accommodate the version of the
procedures in the final release notes:

http://www.sitening.com/postgresql-update-2005-1

-tfo

--
Thomas F. O'Connell
Co-Founder, Information Architect
Sitening, LLC

Strategic Open Source: Open Your i™

http://www.sitening.com/
110 30th Avenue North, Suite 6
Nashville, TN 37203-6320
615-260-0005

On May 11, 2005, at 12:07 AM, Tom Lane wrote:

> Neil Conway <neilc(at)samurai(dot)com> writes:
>> Note that if you're upgrading within a release series (e.g. 8.0.x to
>> 8.0.3) without a dump and reload, you will _not_ get the necessary
>> system catalog changes automatically. Tom's earlier mail describes the
>> procedure needed to correct the system catalog:
>
>> http://www.postgresql.org/about/news.315
>
> Also, note that that message was the zero-day-security-problem response
> to the issue, and that we since figured out cleaner responses. If you
> haven't yet implemented this in your own DBs, I would suggest following
> the procedures given in the final release notes, eg
> http://developer.postgresql.org/docs/postgres/release-7-4-8.html
>
> I expect these notes will shortly show up in the static documentation,
> eg
> http://www.postgresql.org/docs/7.4/static/release.html
> but they aren't there yet as I set finger to keyboard.
>
> regards, tom lane

Hello !

I try the update to PG 8.0.3 win32, but the archive is corrupted !?
I obtain the same thing from all the mirrors where I connect...

How can I obtain the new Win32 release ?

Luc

----- Original Message -----
From: "Neil Conway" <neilc(at)samurai(dot)com>
To: "Marc G. Fournier" <scrappy(at)postgresql(dot)org>
Cc: <pgsql-announce(at)postgresql(dot)org>; <pgsql-general(at)postgresql(dot)org>
Sent: Wednesday, May 11, 2005 2:39 AM
Subject: Re: [ANNOUNCE] [GENERAL] SECURITY RELEASES: 7.2.8 - 7.3.10 -
7.4.8 - 8.0.3

> Marc G. Fournier wrote:
>> Please note that the security issues were those already reported by Tom
>> Lane, as well as a manual fix for them. These releases are mainly to
>> ensure that those installing and/or upgrading existing installations have
>> those fixes automatically.
>
> Note that if you're upgrading within a release series (e.g. 8.0.x to
> 8.0.3) without a dump and reload, you will _not_ get the necessary system
> catalog changes automatically. Tom's earlier mail describes the procedure
> needed to correct the system catalog:
>
> http://www.postgresql.org/about/news.315
>
> -Neil
>
> ---------------------------(end of broadcast)---------------------------
> TIP 6: Have you searched our list archives?
>
> http://archives.postgresql.org
>

Yes I had that same experience last evening, I was going to write about that
today. But I second your thoughts !

Luc ROLLAND wrote:
> Hello !
>
> I try the update to PG 8.0.3 win32, but the archive is corrupted !?
> I obtain the same thing from all the mirrors where I connect...
>
> How can I obtain the new Win32 release ?
>
> Luc
>
> ----- Original Message ----- From: "Neil Conway" <neilc(at)samurai(dot)com>
> To: "Marc G. Fournier" <scrappy(at)postgresql(dot)org>
> Cc: <pgsql-announce(at)postgresql(dot)org>; <pgsql-general(at)postgresql(dot)org>
> Sent: Wednesday, May 11, 2005 2:39 AM
> Subject: Re: [ANNOUNCE] [GENERAL] SECURITY RELEASES: 7.2.8 - 7.3.10 -
> 7.4.8 - 8.0.3
>
>
>> Marc G. Fournier wrote:
>>
>>> Please note that the security issues were those already reported by
>>> Tom Lane, as well as a manual fix for them. These releases are
>>> mainly to ensure that those installing and/or upgrading existing
>>> installations have those fixes automatically.
>>
>>
>> Note that if you're upgrading within a release series (e.g. 8.0.x to
>> 8.0.3) without a dump and reload, you will _not_ get the necessary
>> system catalog changes automatically. Tom's earlier mail describes the
>> procedure needed to correct the system catalog:
>>
>> http://www.postgresql.org/about/news.315
>>
>> -Neil
>>
>> ---------------------------(end of broadcast)---------------------------
>> TIP 6: Have you searched our list archives?
>>
>> http://archives.postgresql.org
>>
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 2: you can get off all lists at once with the unregister command
> (send "unregister YourEmailAddressHere" to majordomo(at)postgresql(dot)org)

--
Aly Dharshi
aly(dot)dharshi(at)telus(dot)net

"A good speech is like a good dress
that's short enough to be interesting
and long enough to cover the subject"