PostgreSQL update addressing vulnerabilities. Release of the pgcat replication system

Updates have been formed corrective updates for all supported branches of PostgreSQL: 12.2, 11.7, 10.12, 9.6.17, 9.5.21 and 9.4.26. Release 9.4.26 is final — preparations for updates for branch 9.4 the distribution of the plugin-container binary has been discontinued.. Updates for branch 9.5 will be formed until February 2021, 9.6 — until November 2021, 10 — until November 2022, 11 — until November 2023, 12 — until November 2024.

In the new versions, 75 bugs have been fixed and a vulnerability has been addressed
(CVE-2020-1720), caused by lack of authorization checks when executing the command "ALTER … DEPENDS ON EXTENSION". Under certain circumstances, the vulnerability allows an unprivileged user to delete any function, procedure, materialized view, index, or trigger. An attack is possible if the administrator has installed any extension, and the user can execute the CREATE command or the extension owner can be convinced to execute the DROP EXTENSION command.

Additionally, it is worth noting the appearance of a new application pgcat, allowing data replication between several PostgreSQL servers. The program supports logical replication through streaming and replaying SQL commands executed on the main server that lead to data modifications on another host. The code is written in Go and is distributed is licensed under Apache 2.0. The main differences from the built-in logical replication mechanism are:

  • Support for any types of target tables (views, fdw (Foreign Data Wrapper), partitioned tables, distributed tables citus);
  • Ability to override table names (replication from one table to another);
  • Support for bidirectional replication by transmitting only local changes while ignoring incoming replications;
  • Presence of a conflict resolution system based on the LWW (last-writer-win) algorithm;
  • Ability to maintain information about the progress of replication and unapplied replicas in a separate table, which can be used for recovery after restarting a temporarily unavailable receiving node.

Source: opennet.ru

Buy reliable website hosting with DDoS protection, VPS VDS servers 🔥 Buy reliable website hosting with DDoS protection, VPS VDS servers | ProHoster