The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 14.3, 13.7, 12.11, 11.16, and 10.21. This release closes one security vulnerability and fixes over 50 bugs reported over the last three months.
We encourage you to install this update at your earliest possible convenience.
For the full list of changes, please review the release notes.
PostgreSQL 10 will stop receiving fixes on November 10, 2022. If you are running PostgreSQL 10 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.
Versions Affected: 10 - 14. The security team typically does not test unsupported versions, but this problem is quite old.
REFRESH MATERIALIZED VIEW,
pg_amcheck made incomplete efforts to operate safely when a privileged
user is maintaining another user's objects. Those commands activated relevant
protections too late or not at all. An attacker having permission to create
non-temp objects in at least one schema could execute arbitrary SQL functions
under a superuser identity.
While promptly updating PostgreSQL is the best remediation for most users, a
user unable to do that can work around the vulnerability by disabling
autovacuum, not manually running the above commands, and not restoring from
output of the
pg_dump command. Performance may degrade quickly under this
VACUUM is safe, and all commands are fine when a trusted user
owns the target object.
The PostgreSQL project thanks Alexander Lakhin for reporting this problem.
This update fixes over 50 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 14. Some of these issues may also affect other supported versions of PostgreSQL.
Included in this release:
ltreecolumns. After upgrading, you will need to reindex any GiST indexes on
tbl.*) outside of a top-level of a
SELECTlist are now always associated with those of the associated named composite type, if there is one. The release notes detail a workaround if you depend on the previous behavior.
CYCLEfeatures contains a duplicate common-table expression (
ALTER FUNCTIONto support changing a function's parallelism property and its
SET-variable list in the same command.
CLUSTERon an index whose leading key is an expression.
DROP TABLESPACEand checkpointing that could fail to remove all dead files from the tablespace directory.
TRUNCATEcommand that overlaps with a checkpoint.
_as the first character in a custom configuration parameter name.
PANIC: xlog flush request is not satisfiedfailure during standby promotion when there is a missing WAL continuation record.
pageinspectto improve overall stability.
BEFORE INSERT ... FOR EACH ROWtriggers exist on the foreign table.
This update also contains the tzdata release 2022a for DST law changes in Palestine, plus historical corrections for Chile and Ukraine.
For the full list of changes available, please review the release notes.
All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use
order to apply this update release; you may simply shutdown PostgreSQL and
update its binaries.
Users who have skipped one or more update releases may need to run additional, post-update steps; please see the release notes for earlier versions for details.
For more details, please see the release notes.