postgresql-16.4

[Bruce Dubbs]

New minor version.

[Douglas R. Reno]

Security Fix:

CVE-2024-7348: PostgreSQL relation replacement during pg_dump executes arbitrary SQL

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 12 - 16.

An attacker able to create and drop non-temporary objects could inject SQL code that 
would be executed by a concurrent pg_dump session with the privileges of the role 
running pg_dump (which is often a superuser). The attack involves replacing a sequence 
or similar object with a view or foreign table that will execute malicious code. To 
prevent this, introduce a new server parameter restrict_nonsystem_relation_kind that can 
disable expansion of non-builtin views as well as access to foreign tables, and teach 
pg_dump to set it when available. Note that the attack is prevented only if both pg_dump 
and the server it is dumping from are new enough to have this fix.

The PostgreSQL project thanks Noah Misch for reporting this problem.

Bug Fixes

    Avoid incorrect results from "Merge Right Anti Join" plans, where if the inner 
relation is known to have unique join keys, the merge could misbehave when there are 
duplicated join keys in the outer relation.
    Prevent infinite loop in VACUUM.
    Fix partition pruning setup during ALTER TABLE DETACH ... PARTITION CONCURRENTLY.
    Fix behavior of stable functions that are used as an argument to a CALL statement.
    pg_sequence_last_value() now returns NULL instead of throwing an error when called 
on unlogged sequences on standby servers and on temporary sequences of other sessions.
    Fix parsing of ignored operators in websearch_to_tsquery().
    Correctly check updatability of view columns targeted by INSERT ... DEFAULT.
    Lock owned sequences during ALTER TABLE ... SET LOGGED|UNLOGGED.
    Don't throw an error if a queued AFTER trigger no longer exists.
    Fix selection of an arbiter index for INSERT ... ON CONFLICT when the desired index 
has expressions or predicates, for example, through an updatable view.
    Refuse to modify a temporary table of another session with ALTER TABLE.
    Fix handling of extended statistics on expressions in CREATE TABLE ... LIKE 
STATISTICS.
    Fix failure to recalculate sub-queries generated from MIN() or MAX() aggregates.
    Disallow underscores in positional parameters.
    Avoid crashing when a JIT-inlined backend function throws an error.
    Fix handling of subtransactions of prepared transactions when starting a hot standby 
server.
    Prevent incorrect initialization of logical replication slots.
    Fix memory leak in the logical replication WAL sender when publishing changes to a 
partitioned table whose partitions have row types that are physically different from the 
table.
    Disable creation of stateful TLS session tickets by OpenSSL.
    Fix how PL/pgSQL handles integer ranges containing underscores (e.g., FOR i IN 
1_001..1_002).
    Fix incompatibility between PL/Perl and Perl 5.40.
    Several fixes related to recursive PL/Python functions and triggers.
    Ensure that pg_restore -l reports dependent table of contents entries correctly.
    pg_stat_statements now passes a query ID for utility (non-SELECT/INSERT/UPDATE) 
statements that appears in SQL-language functions.
    Fix for postgres_fdw when mapping a foreign table to a nontrivial remote view.
    postgres_fdw no longer sends a FETCH FIRST WITH TIES clause to a remote server.

[Douglas R. Reno]

Fixed at a775af29dfbee189c94530601d6d99fe3eff449c

SA-12.1-088 issued