PostgreSQL 13

对于希望从任何先前版本迁移数据的用户，需要使用pg_dumpall进行导出/恢复，或使用pg_upgrade或逻辑复制。有关迁移到新主版本的一般信息，请参见第 18.6 节。

版本 13 包含许多可能影响与先前版本兼容性的变更。请注意以下不兼容性：

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

以上保留官方英文漏洞说明。

本分支修复于：13.22。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.22：在 pg_dump 输出的注释中，将名称中包含的换行符转换为空格

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

以上保留官方英文漏洞说明。

本分支修复于：13.22。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.22：防止 pg_dump 脚本被用于攻击执行恢复的用户

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

以上保留官方英文漏洞说明。

本分支修复于：13.22。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

发布说明中的提及：

• 13.22：加强规划器估算函数中的安全检查

Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.

以上保留官方英文漏洞说明。

本分支修复于：13.21。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

发布说明中的提及：

• 13.21：避免在检查声称为 GB18030 编码的无效编码字符串时发生单字节缓冲区越界读取

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

以上保留官方英文漏洞说明。

本分支修复于：13.23。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

发布说明中的提及：

• 13.23：避免 libpq 中分配大小计算的整数溢出

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

以上保留官方英文漏洞说明。

本分支修复于：13.23。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

发布说明中的提及：

• 13.23：检查 CREATE STATISTICS 中模式的 CREATE 权限

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

以上保留官方英文漏洞说明。

本分支修复于：13.19。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.20：改进 libpq 引用函数的行为
• 13.19：加强 PQescapeString 及相关函数对无效编码输入字符串的防护

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected. The PostgreSQL project thanks Noah Misch for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.16。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.16：防止在 pg_dump 期间执行未经授权的代码

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH ). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. The PostgreSQL project thanks Coby Abrams for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.17。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.17：防止受信任的 PL/Perl 代码更改环境变量

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE , SET SESSION AUTHORIZATION , or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION . The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. The PostgreSQL project thanks Tom Lane for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.17。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

发布说明中的提及：

• 13.18：恢复 ALTER {ROLE|DATABASE} SET role 的功能
• 13.17：修复 SET SESSION AUTHORIZATION 与 SET ROLE 之间意外的交互

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results. This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected. The PostgreSQL project thanks Jacob Champion for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.17。组件：client。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

发布说明中的提及：

• 13.17：使 libpq 丢弃在 SSL 或 GSS 协议协商期间收到的错误消息

Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CVE-2016-2193 fixed most interaction between row security and user ID changes. They missed cases where a subquery, WITH query, security invoker view, or SQL-language function references a table with a row-level security policy. This has the same consequences as the two earlier CVEs. That is to say, it leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. An attacker must tailor an attack to a particular application's pattern of query plan reuse, user ID changes, and role-specific row security policies. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

以上保留官方英文漏洞说明。

本分支修复于：13.17。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

发布说明中的提及：

• 13.17：确保当 RLS 应用于非顶级表引用时，缓存的执行计划被标记为依赖于调用角色

UPDATE (June 19, 2024) : Added v16 as impacted. Updated description to clarify the attack vector. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view.

以上保留官方英文漏洞说明。

本分支修复于：13.14。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.14：加强 REFRESH MATERIALIZED VIEW CONCURRENTLY 中的安全限制

Documentation says the pg_signal_backend role cannot signal "a backend owned by a superuser". On the contrary, it can signal background workers, including the logical replication launcher. It can signal autovacuum workers and the autovacuum launcher. Signaling autovacuum workers and those two launchers provides no meaningful exploit, so exploiting this vulnerability requires a non-core extension with a less-resilient background worker. For example, a non-core background worker that does not auto-restart would experience a denial of service with respect to that particular background worker. The PostgreSQL project thanks Hemanth Sandrana and Mahendrakar Srinivasarao for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.13。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

发布说明中的提及：

• 13.13：防止 pg_signal_backend 角色向后台工作进程和自动清理进程发送信号

While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some attacks of this description, but it missed others. The PostgreSQL project thanks Pedro Gallegos for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.13。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.16：检测计算新数组维度时的另一个整数溢出情况
• 13.13：检测计算新数组维度时的整数溢出

Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have not confirmed or ruled out viability of attacks that arrange for presence of notable, confidential information in disclosed bytes. The PostgreSQL project thanks Jingzhou Fu for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.13。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

发布说明中的提及：

• 13.13：修复 DISTINCT "any" 聚合函数中对未知类型参数的处理

An extension script is vulnerable if it uses @extowner@ , @extschema@ , or @extschema:...@ inside a quoting construct (dollar quoting, '' , or "" ). No bundled extension is vulnerable. Vulnerable uses do appear in a documentation example and in non-bundled extensions. Hence, the attack prerequisite is an administrator having installed files of a vulnerable, trusted, non-bundled extension. Subject to that prerequisite, this enables an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. PostgreSQL will block this attack in the core server, so there's no need to modify individual extensions. The PostgreSQL project thanks Micah Gates, Valerie Woolard, Tim Carey-Smith, and Christoph Berg for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.12。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.12：如果模式或所有者名称包含引号、反斜杠或美元符号，则不允许将其替换到扩展脚本中

While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving function inlining. This leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLE s. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. The PostgreSQL project thanks Wolfgang Walther for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.11。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

发布说明中的提及：

• 13.11：在内联集合返回函数后正确执行行级安全策略

This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to other users. The PostgreSQL project thanks Alexander Lakhin for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.11。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.11：防止 CREATE SCHEMA 绕过 search_path 的更改

A modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. When a libpq client application has a Kerberos credential cache and doesn't explicitly disable option gssencmode , a server can cause libpq to over-read and report an error message containing uninitialized bytes from and following its receive buffer. If libpq's caller somehow makes that message accessible to the attacker, this achieves a disclosure of the over-read bytes. We have not confirmed or ruled out viability of attacks that arrange for a crash or for presence of notable, confidential information in disclosed bytes. The PostgreSQL project thanks Jacob Champion for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.10。组件：client。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

发布说明中的提及：

• 13.10：libpq 在 GSSAPI 传输加密初始化失败后可能泄漏内存内容

Some extensions use CREATE OR REPLACE or CREATE IF NOT EXISTS commands. Some don't adhere to the documented rule to target only objects known to be extension members already. An attack requires permission to create non-temporary objects in at least one schema, ability to lure or wait for an administrator to create or update an affected extension in that schema, and ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS . Given all three prerequisites, the attacker can run arbitrary code as the victim role, which may be a superuser. Known-affected extensions include both PostgreSQL-bundled and non-bundled extensions. PostgreSQL is blocking this attack in the core server, so there's no need to modify individual extensions. The PostgreSQL project thanks Sven Klemm for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.8。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.8：不允许扩展脚本替换不属于该扩展的已有对象

Autovacuum, REINDEX , CREATE INDEX , REFRESH MATERIALIZED VIEW , CLUSTER , and pg_amcheck made incomplete efforts to operate safely when a privileged user is maintaining another user's objects. Those commands activated relevant protections too late or not at all. An attacker having permission to create non-temp objects in at least one schema could execute arbitrary SQL functions under a superuser identity. While promptly updating PostgreSQL is the best remediation for most users, a user unable to do that can work around the vulnerability by disabling autovacuum, not manually running the above commands, and not restoring from output of the pg_dump command. Performance may degrade quickly under this workaround. VACUUM is safe, and all commands are fine when a trusted user owns the target object. The PostgreSQL project thanks Alexander Lakhin for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.7。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.8：修复 CREATE INDEX 中的权限检查
• 13.7：将更多操作限制在“安全受限操作”沙箱内

A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0 , the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.

以上保留官方英文漏洞说明。

本分支修复于：13.4。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

发布说明中的提及：

• 13.4：修复重复应用投影步骤时产生错误计划的问题

尚未记录本分支的修复版本。

发布说明中的提及：

• 13.4：更彻底地禁止 SSL 重新协商

A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message. This is similar to CVE-2014-8161 , but the conditions to exploit are more rare. The PostgreSQL project thanks Heikki Linnakangas for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.2。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

发布说明中的提及：

• 13.2：修复违反约束的错误消息中的信息泄漏

Using an UPDATE ... RETURNING on a purpose-crafted partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas typically cannot use this attack at will. The PostgreSQL project thanks Tom Lane for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.3。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

发布说明中的提及：

• 13.3：修复涉及连接的跨分区更新中 UPDATE ... RETURNING 输出可能计算不正确的问题

Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas cannot use this attack at will. The PostgreSQL project thanks Andres Freund for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.3。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

发布说明中的提及：

• 13.3：修复 INSERT ... ON CONFLICT ... UPDATE 目标列表中对 “junk” 列的错误处理

While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The PostgreSQL project thanks Tom Lane for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.3。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

发布说明中的提及：

• 13.3：防止数组下标计算中的整数溢出

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. If more preconditions hold, the attacker can exfiltrate the client's password or other confidential data that might be transmitted early in a session. The attacker must have a way to trick the client's intended server into making the confidential data accessible to the attacker. A known implementation having that property is a PostgreSQL configuration vulnerable to CVE-2021-23214 . As with any exploitation of CVE-2021-23214 , the server must be using trust authentication with a clientcert requirement or using cert authentication. To disclose a password, the client must be in possession of a password, which is atypical when using an authentication configuration vulnerable to CVE-2021-23214 . The attacker must have some other way to access the server to retrieve the exfiltrated data (a valid, unprivileged login account would be sufficient). The PostgreSQL project thanks Jacob Champion for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.5。组件：client。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

发布说明中的提及：

• 13.5：使 libpq 在 SSL 或 GSS 加密握手后拒绝多余的数据

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This is similar to CVE-2011-0411 (different product). The PostgreSQL project thanks Jacob Champion for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.5。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.5：使服务器在 SSL 或 GSS 加密握手后拒绝多余的数据
• 13.5：使 libpq 在 SSL 或 GSS 加密握手后拒绝多余的数据

A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed. The PostgreSQL project thanks Sven Klemm for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.2。组件：core server。

官方受影响分支记录：13。

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

发布说明中的提及：

• 13.2：修复某些连接查询中未检查逐列 SELECT 权限的问题

The \gset meta-command, which sets psql variables based on query results, does not distinguish variables that control psql behavior. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql . Using \gset with a prefix not found among specially treated variables, e.g. any lowercase string, precludes the attack in an unpatched psql . The PostgreSQL project thanks Nick Cleaton for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.1。组件：client。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.1：防止 psql 的 \gset 命令修改具有特殊处理方式的变量

An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. While promptly updating PostgreSQL is the best remediation for most users, a user unable to do that can work around the vulnerability by disabling autovacuum and not manually running ANALYZE , CLUSTER , REINDEX , CREATE INDEX , VACUUM FULL , REFRESH MATERIALIZED VIEW , or a restore from output of the pg_dump command. Performance may degrade quickly under this workaround. VACUUM without the FULL option is safe, and all commands are fine when a trusted user owns the target object. The PostgreSQL project thanks Etienne Stalmans for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.1。组件：core server。

官方受影响分支记录：13。

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.1：禁止在索引表达式和物化视图查询中执行 DECLARE CURSOR ... WITH HOLD 以及触发延迟触发器

Many PostgreSQL-provided client applications have options that create additional database connections. Some of those applications reuse only the basic connection parameters (e.g. host , user , port ), dropping others. If this drops a security-relevant parameter (e.g. channel_binding , sslmode , requirepeer , gssencmode ), the attacker has an opportunity to complete a MITM attack or observe cleartext transmission. Affected applications are clusterdb , pg_dump , pg_restore , psql , reindexdb , and vacuumdb . The vulnerability arises only if one invokes an affected client application with a connection string containing a security-relevant parameter. This also fixes how the \connect command of psql reuses connection parameters, i.e. all non-overridden parameters from a previous connection string now re-used. The PostgreSQL project thanks Peter Eisentraut for reporting this problem.

以上保留官方英文漏洞说明。

本分支修复于：13.1。组件：client。

官方受影响分支记录：13。

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

发布说明中的提及：

• 13.1：修复 pg_dump、pg_restore、clusterdb、reindexdb 和 vacuumdb 对复杂连接字符串参数的使用
• 13.1：当 psql 的 \connect 命令复用连接参数时，确保复用先前连接字符串中所有未被覆盖的参数

尚未记录本分支的修复版本。组件：core server。

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

发布说明中的提及：

• 13.22：加强规划器估算函数中的安全检查

尚未记录本分支的修复版本。

发布说明中的提及：

• 13.22：在 pg_dump 输出的注释中，将名称中包含的换行符转换为空格

尚未记录本分支的修复版本。

发布说明中的提及：

• 13.4：在 psql 和其他客户端程序中，避免处理编码无效的数据时越过字符串末尾