4 ms·

PostgreSQL 16.3, 15.7, 14.12, 13.15, and 12.19 Released

• sroussey 2y ago
  “A security vulnerability was found in the system views pg_stats_ext and pg_stats_ext_exprs, potentially allowing authenticated database users to see data they don't have sufficient privileges to view. The fix for this vulnerability only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after this fix is applied. If you have a current PostgreSQL installation and are concerned about this issue, please follow the instructions in the "Updating" section for remediation steps… For existing installations that are impacted by CVE-2024-4317 that wish to remediate the issue, you will have to perform the following steps…” I’m not a fan of needing to run a script to fix a security issue in addition to updating the software. What if someone skips this and updates some later version?
  • whatevaa 2y ago
    Lot's of installations will not notice this. Issue is probably not very serious if this approach was chosen.
  • pwagland 2y ago
    As I understand this, you don't need to get the update at all if you run the script? But your question is also addressed in the "Updating" section: > Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details. You need to read the Updating section of every version that you have skipped. This is also called out in the release notes: > Also, if you are upgrading from a version earlier than 14.11, see Section E.2. Where E.2 is the 14.11 update notes, and so on.