Database | News
PostgreSQL Update Targets 'High-Exposure Security Vulnerability'
PostgreSQL's developers are strongly urging users of version 9.x to upgrade their software "immediately."
The PostgreSQL Global Development Group today released updates addressing a "high-exposure security vulnerability in versions 9.0 and later." The updates are available for 9.0, 9.1, and 9.2 branches, as well as 8.4.
According to developers: "A major security issue fixed in this release, CVE-2013-1899, makes it possible for a connection request containing a database name that begins with "-" to be crafted that can damage or destroy files within a server's data directory. Anyone with access to the port the PostgreSQL server listens on can initiate this request. This issue was discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software Center."
In addition to fixes for one major security issue, the updates also include four more minor security fixes, as well as fixes for other, non-security-related issues. Some of these fixes include:
- A security vulnerability that made contrib/pgcrypto-generated strings too easy to guess;
- A vulnerability that would allow unprivileged users to interfere with backups;
- Security issues involving the OS X and Linux installers;
- Vaious issues with GiST indices;
- An issue related to crash recovery; and
- Memory and buffer leaks, among others.
The updates also allow PostgreSQL to be built using Microsoft Visual Studio 2012.
PostgreSQL 9.2.4, 9.1.9, 9.0.13, and 8.4.17 are available now at postgresql.org/download. A complete list of fixes and enhancements in each version can be found on the PostgreSQL release notes archive page.
Executive Producer David Nagel heads up the editorial department for 1105 Media's education publications — which include two daily sites, a variety of newsletters and two monthly digital magazines covering technology in both K-12 and higher education.
A 21-year publishing veteran, Nagel has led or contributed to dozens of technology, art and business publications.
He can be reached at firstname.lastname@example.org. You can also connect with him on LinkedIn at linkedin.com/profile/view?id=10390192 or follow him on Twitter at @THEJournalDave (K-12) or @CampusTechDave (higher education). A selection of David Nagel's articles can be found on this site.