PostgreSQL 9.1.24lts2 Documentation | ||||
---|---|---|---|---|
Prev | Up | Appendix E. Release Notes | Next |
Release Date: 2017-08-08
This release contains a variety of fixes from 9.1.24, adopted from the 9.2.21 release. For information about new features in the 9.1 major release, see Section E.27.
The PostgreSQL community has stopped releasing updates for the 9.1.X release series in October 2016. This update is a Long-Term-Support (LTS) community effort by credativ GmbH and not an official release by the PostgreSQL community.
A dump/restore is not required for those running 9.1.X.
However, if you use foreign data servers that make use of user passwords for authentication, see the first changelog entry below.
Also, if you are upgrading from a version earlier than 9.1.16, see Section E.11.
Restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options (Michael Paquier, Feike Steenbergen)
The previous coding allowed the owner of a foreign server object, or anyone he has granted server USAGE permission to, to see the options for all user mappings associated with that server. This might well include passwords for other users. Adjust the view definition to match the behavior of information_schema.user_mapping_options, namely that these options are visible to the user being mapped, or if the mapping is for PUBLIC and the current user is the server owner, or if the current user is a superuser. (CVE-2017-7486)
By itself, this patch will only fix the behavior in newly initdb'd databases. If you wish to apply this change in an existing database, follow the corrected procedure shown in the changelog entry for CVE-2017-7547, in Section E.1.