corrective updates for all supported branches of PostgreSQL: , , , , and . Release 9.4.26 is final — preparations for updates for branch 9.4 . Updates for branch 9.5 will be formed until February 2021, 9.6 — until November 2021, 10 — until November 2022, 11 — until November 2023, 12 — until November 2024.
In the new versions, 75 bugs have been fixed and a vulnerability has been addressed
(CVE-2020-1720), caused by lack of authorization checks when executing the command "ALTER … DEPENDS ON EXTENSION". Under certain circumstances, the vulnerability allows an unprivileged user to delete any function, procedure, materialized view, index, or trigger. An attack is possible if the administrator has installed any extension, and the user can execute the CREATE command or the extension owner can be convinced to execute the DROP EXTENSION command.
Additionally, it is worth noting the appearance of a new application , allowing data replication between several PostgreSQL servers. The program supports logical replication through streaming and replaying SQL commands executed on the main server that lead to data modifications on another host. The code is written in Go and is licensed under Apache 2.0. The main differences from the built-in logical replication mechanism are:
- Support for any types of target tables (views, fdw (Foreign Data Wrapper), partitioned tables, distributed tables citus);
- Ability to override table names (replication from one table to another);
- Support for bidirectional replication by transmitting only local changes while ignoring incoming replications;
- Presence of a conflict resolution system based on the LWW (last-writer-win) algorithm;
- Ability to maintain information about the progress of replication and unapplied replicas in a separate table, which can be used for recovery after restarting a temporarily unavailable receiving node.
Source: opennet.ru
