The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 12.3, 11.8, 10.13, 9.6.18, and 9.5.22. This release fixes one security issue found in the PostgreSQL server and over 75 bugs reported over the last three months.
Please plan to update at your earliest convenience.
Versions Affected: 9.5 - 12. The security team does not test unsupported versions, but this issue existed before PostgreSQL 9.5.
The Windows installer for PostgreSQL invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.
The PostgreSQL project thanks Hou JingYi (@hjy79425575) for reporting this problem.
This update also fixes over 75 bugs that were reported in the last several months. Some of these issues affect only version 12, but may also affect all supported versions.
Some of these fixes include:
ALTER TABLE, including ensuring the
SET STORAGEdirective is propagated to a table's indexes.
DROP OWNED BYwhile another session is deleting the same objects.
REINDEX CONCURRENTLY, particularly with issues when a
REINDEX CONCURRENTLYoperation fails.
(x,y),r, which is specified in the documentation.
set_bit()functions to not fail on
byteastrings longer than 256MB.
pg_read_all_statsrole can read all statistics views.
psqlwhen attempting to re-establish a failed connection.
ALTER ... DEPENDS ON EXTENSION.
pg_dump, which include dumping comments on RLS policies and postponing restore of event triggers until the end.
pg_basebackupgenerates valid tar files.
pg_checksumsskips tablespace subdirectories that belong to a different PostgreSQL major version
This update also contains tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.
For the full list of changes available, please review the release notes.
All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use
order to apply this update release; you may simply shutdown PostgreSQL and
update its binaries.
Users who have skipped one or more update releases may need to run additional, post-update steps; please see the release notes for earlier versions for details.
For more details, please see the release notes.