Corrective updates have been formulated for all supported branches of PostgreSQL: 14.3, 13.7, 12.11, 11.16, and 10.22. The 10.x branch is nearing the end of its support period (updates will be formulated until November 2022). The release of updates for the 11.x branch will continue until November 2023, 12.x until November 2024, 13.x until November 2025, and 14.x until November 2026.
The new versions include over 50 fixes and address the CVE-2022-1552 vulnerability, which could allow an attacker to bypass the isolation of privileged operations such as Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck. An attacker with the ability to create non-temporary objects in any storage schema may execute arbitrary SQL functions with superuser privileges during the execution of the aforementioned operations by a privileged user concerning the attacking object's context. Exploitation of this vulnerability may also occur during automatic database cleanup while executing the autovacuum handler.
If updating is not possible, as a workaround to bypass the blocking issue, autovacuum can be disabled, and privileged users can refrain from performing operations like REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, and CLUSTER, as well as refrain from running the pg_amcheck utility or restoring content from backups created by the pg_dump utility. Performing VACUUM is considered safe, as are any command operations, provided the objects being processed belong to trusted users.
Other changes in the new releases include updates to the JIT code for compatibility with LLVM 14, allowing the use of database.schema.table templates in the utilities psql, pg_dump, and pg_amcheck, fixing issues leading to corruption of GiST indexes over ltree columns, incorrect rounding of epoch-formatted values extracted from interval type data, incorrect scheduler operation with asynchronous remote queries, incorrect table row sorting when using the CLUSTER expression over indexes based on expressions, data loss during abrupt termination immediately after building a sorted GiST index, deadlocks when deleting partitioned indexes, and a race condition between the DROP TABLESPACE operation and checkpointing.
Additionally, the release of the pg_ivm 1.0 extension has been noted, providing support for IVM (Incremental View Maintenance) for PostgreSQL 14. IVM offers an alternative method for updating materialized views, which is more efficient when changes affect a small part of the view. IVM allows for instantaneous updates to materialized views by applying only incremental changes, without recomputing the view as required by the 'REFRESH MATERIALIZED VIEW' operation.
Source: opennet.ru
