{"id":104014,"date":"2022-05-13T03:36:48","date_gmt":"2022-05-13T01:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-postgresql-s-ustraneniem-uyazvimosti-vypusk-pg_ivm-1-0"},"modified":"2022-05-13T03:36:48","modified_gmt":"2022-05-13T01:36:48","slug":"obnovlenie-postgresql-s-ustraneniem-uyazvimosti-vypusk-pg_ivm-1-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-postgresql-s-ustraneniem-uyazvimosti-vypusk-pg_ivm-1-0","title":{"rendered":"PostgreSQL update addressing vulnerabilities. Release of pg_ivm 1.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Correction updates have been prepared for all supported branches of PostgreSQL: 14.3, 13.7, 12.11, 11.16, and 10.22. The 10.x branch is approaching the end of its support period (updates will continue until November 2022). Updates for the 11.x branch will last until November 2023, for 12.x until November 2024, for 13.x until November 2025, and for 14.x until November 2026. <\/p>\n
The new versions include over 50 fixes and address the CVE-2022-1552 vulnerability, which could allow an attacker to bypass the isolation of privileged operations such as Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck. An attacker with the ability to create non-temporary objects in any storage schema may execute arbitrary SQL functions with superuser privileges during the execution of the aforementioned operations by a privileged user concerning the attacking object's context. Exploitation of this vulnerability may also occur during automatic database cleanup while executing the autovacuum handler. <\/p>\n
If updating is not possible, as a workaround to bypass the blocking issue, autovacuum can be disabled, and privileged users can refrain from performing operations like REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, and CLUSTER, as well as refrain from running the pg_amcheck utility or restoring content from backups created by the pg_dump utility. Performing VACUUM is considered safe, as are any command operations, provided the objects being processed belong to trusted users. <\/p>\n
Other changes in the new releases include updates to the JIT code for compatibility with LLVM 14, allowing the use of database.schema.table templates in the utilities psql, pg_dump, and pg_amcheck, fixing issues leading to corruption of GiST indexes over ltree columns, incorrect rounding of epoch-formatted values extracted from interval type data, incorrect scheduler operation with asynchronous remote queries, incorrect table row sorting when using the CLUSTER expression over indexes based on expressions, data loss during abrupt termination immediately after building a sorted GiST index, deadlocks when deleting partitioned indexes, and a race condition between the DROP TABLESPACE operation and checkpointing. <\/p>\n
Additionally, the release of the pg_ivm 1.0 extension can be noted, which implements support for IVM (Incremental View Maintenance) for PostgreSQL 14. IVM offers an alternative way to update materialized views that is more efficient when changes affect only a small part of the view. IVM allows for instant updates of materialized views by applying only incremental changes, without recomputing the view, which is done when using the 'REFRESH MATERIALIZED VIEW' operation. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"