PostgreSQL 11.3, 10.8, 9.6.13, 9.5.17, & 9.4.22 released: bugs & security fix

PostgreSQL 11

PostgreSQL, often simply Postgres, is an object-relational database management system (ORDBMS) with an emphasis on extensibility and standards compliance. It can handle workloads ranging from small single-machine applications to large Internet-facing applications (or for data warehousing) with many concurrent users; on macOS Server, PostgreSQL is the default database; and it is also available for Microsoft Windows and Linux (supplied in most distributions).

PostgreSQL is ACID-compliant and transactional. PostgreSQL has updatable views and materialized views, triggers, foreign keys; supports functions and stored procedures, and other expandability.

PostgreSQL is developed by the PostgreSQL Global Development Group, a diverse group of many companies and individual contributors. It is free and open-source, released under the terms of the PostgreSQL License, a permissive software license. _Wiki


Changelog 11.3, 10.8, 9.6.13, 9.5.17, & 9.4.22

This release fixes two security issues in the PostgreSQL server, a security issue found in two of the PostgreSQL Windows installers, and over 60 bugs reported over the last three months.

Security Issues

  • CVE-2019-10127: BigSQL Windows installer does not clear permissive ACL entries
  • CVE-2019-10128: EnterpriseDB Windows installer does not clear permissive ACL entries
  • CVE-2019-10129: Memory disclosure in partition routing
  • CVE-2019-10130: Selectivity estimators bypass row security policies.This issue is present in PostgreSQL 9.5, 9.6, 10, and 11. The PostgreSQL project thanks Dean Rasheed for reporting this problem.

Bug Fixes and Improvements

Some of these fixes include:

  • Several catalog corruption fixes, including one related to running ALTER TABLE on a partitioned table
  • Several fixes for partitioning
  • Avoid server crash when an error occurs while trying to persist a cursor query across a transaction commit
  • Avoid O(N^2) performance issue when rolling back a transaction that created many tables
  • Fix possible “could not access status of transaction” failures in txid_status()
  • Fix updatable views to handle explicit DEFAULT items in INSERT .. VALUES statements where there are multiple VALUES rows
  • Fix CREATE VIEW to allow zero-column views
  • Add missing support for the CREATE TABLE IF NOT EXISTS .. AS EXECUTE .. statement
  • Ensure that sub-SELECTs appearing in row-level-security policy expressions are executed with the correct user’s permissions
  • Accept XML documents as valid values of type xml when xmloption is set to content, as required by SQL:2006 and later
  • Fix incompatibility of GIN-index WAL records that were introduced in 11.2, 10.7, 9.6.12, 9.5.16, and 9.4.21 that affected replica servers running these versions reading in changes to GIN indexes from primary servers of older versions
  • Several memory leak fixes as well as fixes to management of dynamic shared memory
  • Relax panics on fsync and sync_file_range failures for certain cases where a failure indicated “operation not supported”
  • Several fixes to the query planner, several of which should lead to planning improvements
  • Fix race condition in which a hot-standby postmaster could fail to shut down after receiving a smart-shutdown request
  • Several fixes for SCRAM authentication
  • Fix handling of lc_time settings that imply an encoding different from the database’s encoding
  • Create the current_logfiles file with the same permissions as other files in the server’s data directory
  • Several ecpg fixes
  • Make pg_verify_checksums verify that the data directory it’s pointed at is of the right PostgreSQL version
  • Several fixes for contrib/postgres_fdw, including one for remote partitions where an UPDATE could lead to incorrect results or a crash
  • Several Windows fixes