From: Tom Lane Date: Mon, 5 Feb 2024 16:51:11 +0000 (-0500) Subject: Last-minute updates for release notes. X-Git-Tag: REL_14_11~1 X-Git-Url: http://git.postgresql.org/gitweb/?a=commitdiff_plain;h=25ee45b7caa992896477841baf8791d8e7fb4e79;p=postgresql.git Last-minute updates for release notes. Security: CVE-2024-0985 (not CVE-2023-5869 as claimed in prior commit msg) --- diff --git a/doc/src/sgml/release-14.sgml b/doc/src/sgml/release-14.sgml index 820855580d0..90019bd0ff8 100644 --- a/doc/src/sgml/release-14.sgml +++ b/doc/src/sgml/release-14.sgml @@ -41,6 +41,50 @@ + + Tighten security restrictions within REFRESH MATERIALIZED + VIEW CONCURRENTLY (Heikki Linnakangas) + + + + One step of a concurrent refresh command was run under weak security + restrictions. If a materialized view's owner could persuade a + superuser or other high-privileged user to perform a concurrent + refresh on that view, the view's owner could control code executed + with the privileges of the user running REFRESH. + Fix things so that all user-determined code is run as the view's + owner, as expected. + + + + The only known exploit for this error does not work + in PostgreSQL 16.0 and later, so it may + be that v16 is not vulnerable in practice. + + + + The PostgreSQL Project thanks Pedro + Gallegos for reporting this problem. + (CVE-2024-0985) + + + + +