https://www.postgresql.org/docs/9.5/static/release-9-5-13.html Adump/restore is not re...">Recommended update for postgresql95 (moderate) - vulnerability database | Vulners.comhttps://www.postgresql.org/docs/9.5/static/release-9-5-13.html Adump/restore is not re...">https://www.postgresql.org/docs/9.5/static/release-9-5-13.html Adump/restore is not re...">https://www.postgresql.org/docs/9.5/static/release-9-5-13.html Adump/restore is not re...">
Lucene search

K
suseSuseOPENSUSE-SU-2018:1900-1
HistoryJul 06, 2018 - 12:11 a.m.

Recommended update for postgresql95 (moderate)

2018-07-0600:11:08
lists.opensuse.org
57

0.007 Low

EPSS

Percentile

78.4%

This update for postgresql95 fixes the following issues:

  • Update to PostgreSQL 9.5.13:
    • <a href=“https://www.postgresql.org/docs/9.5/static/release-9-5-13.html”>https://www.postgresql.org/docs/9.5/static/release-9-5-13.html</a> A
      dump/restore is not required for those running 9.5.X. However, if the
      function marking mistakes mentioned belowpg_logfile_rotate affect you,
      you will want to take steps to correct your database catalogs.

      The functions query_to_xml, cursor_to_xml, cursor_to_xmlschema,
      query_to_xmlschema, and query_to_xml_and_xmlschema should be marked
      volatile because they execute user-supplied queries that might contain
      volatile operations. They were not, leading to a risk of incorrect query
      optimization. This has been repaired for new installations by correcting
      the initial catalog data, but existing installations will continue to
      contain the incorrect markings. Practical use of these functions seems to
      pose little hazard, but in case of trouble, it can be fixed by manually
      updating these functions’ pg_proc entries, for example: ALTER FUNCTION
      pg_catalog.query_to_xml(text, boolean, boolean, text) VOLATILE. (Note that
      that will need to be done in each database of the installation.) Another
      option is to pg_upgrade the database to a version containing the corrected
      initial data.

Security issue fixed:

  • CVE-2018-1115: Remove public execute privilege from contrib/adminpack’s
    pg_logfile_rotate() function pg_logfile_rotate() is a deprecated wrapper
    for the core function pg_rotate_logfile(). When that function was
    changed to rely on SQL privileges for access control rather than a
    hard-coded superuser check, pg_logfile_rotate() should have been updated
    as well, but the need for this was missed. Hence, if adminpack is
    installed, any user could request a logfile rotation, creating a minor
    security issue. After installing this update, administrators should
    update adminpack by performing ALTER EXTENSION adminpack UPDATE in each
    database in which adminpack is installed. (bsc#1091610)