From 20db9591b241281b0bcc5871418befffca4095a6 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Thu, 13 May 2010 21:26:59 +0000 Subject: [PATCH] Update release notes with security issues. Security: CVE-2010-1169, CVE-2010-1170 --- doc/src/sgml/release-7.4.sgml | 42 +++++++++++++++++++++++++++++++- doc/src/sgml/release-8.0.sgml | 42 +++++++++++++++++++++++++++++++- doc/src/sgml/release-8.1.sgml | 42 +++++++++++++++++++++++++++++++- doc/src/sgml/release-8.2.sgml | 42 +++++++++++++++++++++++++++++++- doc/src/sgml/release-8.3.sgml | 42 +++++++++++++++++++++++++++++++- doc/src/sgml/release-8.4.sgml | 46 ++++++++++++++++++++++++++++++++--- 6 files changed, 248 insertions(+), 8 deletions(-) diff --git a/doc/src/sgml/release-7.4.sgml b/doc/src/sgml/release-7.4.sgml index f6ae8e79ba..edc184b219 100644 --- a/doc/src/sgml/release-7.4.sgml +++ b/doc/src/sgml/release-7.4.sgml @@ -1,4 +1,4 @@ - + @@ -37,6 +37,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Do not allow an unprivileged user to reset superuser-only parameter diff --git a/doc/src/sgml/release-8.0.sgml b/doc/src/sgml/release-8.0.sgml index ed2aa5ca76..b1aeba0d6a 100644 --- a/doc/src/sgml/release-8.0.sgml +++ b/doc/src/sgml/release-8.0.sgml @@ -1,4 +1,4 @@ - + @@ -37,6 +37,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Do not allow an unprivileged user to reset superuser-only parameter diff --git a/doc/src/sgml/release-8.1.sgml b/doc/src/sgml/release-8.1.sgml index 187dfcd763..114cb82d9c 100644 --- a/doc/src/sgml/release-8.1.sgml +++ b/doc/src/sgml/release-8.1.sgml @@ -1,4 +1,4 @@ - + @@ -31,6 +31,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Do not allow an unprivileged user to reset superuser-only parameter diff --git a/doc/src/sgml/release-8.2.sgml b/doc/src/sgml/release-8.2.sgml index ac5c2c2550..5fdc8362e0 100644 --- a/doc/src/sgml/release-8.2.sgml +++ b/doc/src/sgml/release-8.2.sgml @@ -1,4 +1,4 @@ - + @@ -31,6 +31,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Fix possible crash if a cache reset message is received during diff --git a/doc/src/sgml/release-8.3.sgml b/doc/src/sgml/release-8.3.sgml index cac48eebc5..82d35b2e63 100644 --- a/doc/src/sgml/release-8.3.sgml +++ b/doc/src/sgml/release-8.3.sgml @@ -1,4 +1,4 @@ - + @@ -31,6 +31,46 @@ + + + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + Fix possible crash if a cache reset message is received during diff --git a/doc/src/sgml/release-8.4.sgml b/doc/src/sgml/release-8.4.sgml index b3b7267e05..94571b7289 100644 --- a/doc/src/sgml/release-8.4.sgml +++ b/doc/src/sgml/release-8.4.sgml @@ -1,4 +1,4 @@ - + @@ -33,8 +33,48 @@ - Fix error during WAL replay of ALTER ... SET TABLESPACE - (Tom) + Enforce restrictions in plperl using an opmask applied to + the whole interpreter, instead of using Safe.pm + (Tim Bunce, Andrew Dunstan) + + + + Recent developments have convinced us that Safe.pm is too + insecure to rely on for making plperl trustable. This + change removes use of Safe.pm altogether, in favor of using + a separate interpreter with an opcode mask that is always applied. + Pleasant side effects of the change include that it is now possible to + use Perl's strict pragma in a natural way in + plperl, and that Perl's $a and $b + variables work as expected in sort routines, and that function + compilation is significantly faster. (CVE-2010-1169) + + + + + + Prevent PL/Tcl from executing untrustworthy code from + pltcl_modules (Tom) + + + + PL/Tcl's feature for autoloading Tcl code from a database table + could be exploited for trojan-horse attacks, because there was no + restriction on who could create or insert into that table. This change + disables the feature unless pltcl_modules is owned by a + superuser. (However, the permissions on the table are not checked, so + installations that really need a less-than-secure modules table can + still grant suitable privileges to trusted non-superusers.) Also, + prevent loading code into the unrestricted normal Tcl + interpreter unless we are really going to execute a pltclu + function. (CVE-2010-1170) + + + + + + Fix data corruption during WAL replay of + ALTER ... SET TABLESPACE (Tom)