PostgreSQL group releases an update to 9.6.10, 9.5.14, 9.4.19, 9.3.24

Security Issues

The recent release focuses on fixing two major security issues:

Certain host connection parameters defeat client-side security defenses

There was an internal issue in Libpq, a client connection API for PostgreSQL. When trying to reconnect, all the connection state variables couldn’t be reset.

Specifically, the state variable that helps determine whether or not a password is needed for a connection would not be reset. This allowed the users of features requiring libpq, namely, the dblink or postgres_fdw extensions, to login to servers they should not be able to access.

To check if your database has either extension installed, run the following  from your PostgreSQL shell:

\dx dblink|postgres_fdw

Memory disclosure and missing authorization in insert

An attacker can issue CREATE TABLE. This allows the arbitrary bytes of server memory to be easily read with the help of an upsert (INSERT ... ON CONFLICT DO UPDATE) query. By default, any user can easily exploit that. A user with specific INSERT privileges and an UPDATE privilege on at least one column in a given table is capable of updating other columns with the help of a view and an upsert query.

Major Bug Fixes

• There was an issue in VACUUM,  leading to data corruption in certain system catalog tables, this has been fixed with the latest update.
• There are a lot of performance improvements made allowing to replay the write-ahead logs.
Unlock access to the largest independent learning library in Tech for FREE!
Get unlimited access to 7500+ expert-authored eBooks and video courses covering every tech area you can think of.
Renews at €18.99/month. Cancel anytime
START FREE TRIAL
• SQL-standard FETCH FIRST syntax has been fixed to allow parameters ($n), as the standard expects.
• Performance regression related to POSIX semaphores has been fixed for multi-CPU systems running Linux or FreeBSD.
• libpq has been fixed for cases where hostaddr is used.

To get complete information on other bug fixes and improvements, check out the official PostgreSQL release notes.

Handling backup and recovery in PostgreSQL 10 [Tutorial]

How to perform data partitioning in PostgreSQL 10

6 index types in PostgreSQL 10 you should know