From 6060af5ba304f32ae79b0823589c461365812a4e Mon Sep 17 00:00:00 2001 From: Yogesh Sharma Date: Wed, 2 Sep 2026 00:47:28 -0400 Subject: [PATCH v1] PG14 following CVEs were not back patched. Remove CVE-2026-16238, CVE-2026-14681, CVE-2026-14672, and CVE-2026-14676. --- doc/src/sgml/release-14.sgml | 115 ----------------------------------- 1 file changed, 115 deletions(-) diff --git a/doc/src/sgml/release-14.sgml b/doc/src/sgml/release-14.sgml index a5c72b82592..df6ca90c1a8 100644 --- a/doc/src/sgml/release-14.sgml +++ b/doc/src/sgml/release-14.sgml @@ -360,35 +360,6 @@ Branch: REL_14_STABLE [42d333a78] 2026-08-10 06:38:36 -0700 - - Fix multirange type handling - in pg_restore_attribute_stats() - (OpenAI Security Research Team) - - - - pg_restore_attribute_stats() treated multirange - types just like their underlying range type. This works correctly - for the bounds histogram, but it was wrong for all the other - statistics kinds. - - - - The PostgreSQL Project thanks - Amy Burnett (OpenAI Codex Security) - for reporting this problem. - (CVE-2026-16238) - - - - - - - Reject GSSEncRequest after direct SSL connection (Michael Paquier) - - - - After establishing a TLS-encrypted connection, the server would - still accept a request for GSSAPI encryption. If that succeeded, - the connection would proceed using TLS encryption, but it would look - like a GSS connection to the pg_hba rules. - Thus, a pg_hba policy intending to disallow TLS - would not be enforced correctly. - - - - The PostgreSQL Project thanks - p4p3r - for reporting this problem. - (CVE-2026-14681) - - - - - - - Make mock SCRAM authentication secrets more plausible (Nathan Bossart) - - - - If a SCRAM login is attempted against a role that doesn't exist or - doesn't have a SCRAM secret, we generate a mock secret and carry out - the authentication handshake anyway, to avoid revealing these facts - to an attacker. But the mock secret was made with a fixed iteration - count, which in itself can be an observable response discrepancy. - Use the configuration setting scram_iterations - instead, to make the mock secret look more like the installation's - real secrets. - - - - The PostgreSQL Project thanks - Radim Marek - for reporting this problem. - (CVE-2026-14672) - - - - - - - Fix buffer overrun - in contrib/pg_stat_statements (Álvaro Herrera) - - - - Query normalization didn't accurately account for the amount of - space the normalized string would require. - - - - The PostgreSQL Project thanks - Sajeeb Lohani (with TrendAI Zero Day Initiative) and Yuelin Wang - for reporting this problem. - (CVE-2026-14676) - - - - -