~ubuntu-branches/ubuntu/trusty/postgresql-9.3/trusty-updates : contents of doc/src/sgml/html/release-8-0-8.html at revision 27

~ubuntu-branches/ubuntu/trusty/postgresql-9.3/trusty-updates : (revision 27)
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Release 8.0.8</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REV="MADE"
HREF="mailto:pgsql-docs@postgresql.org"><LINK
REL="HOME"
TITLE="PostgreSQL 9.3.13 Documentation"
HREF="index.html"><LINK
REL="UP"
TITLE="Release Notes"
HREF="release.html"><LINK
REL="PREVIOUS"
TITLE="Release 8.0.9"
HREF="release-8-0-9.html"><LINK
REL="NEXT"
TITLE="Release 8.0.7"
HREF="release-8-0-7.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="stylesheet.css"><META
HTTP-EQUIV="Content-Type"
CONTENT="text/html; charset=ISO-8859-1"><META
NAME="creation"
CONTENT="2016-05-09T21:13:26"></HEAD
><BODY
CLASS="SECT1"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="5"
ALIGN="center"
VALIGN="bottom"
><A
HREF="index.html"
>PostgreSQL 9.3.13 Documentation</A
></TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="top"
><A
TITLE="Release 8.0.9"
HREF="release-8-0-9.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="top"
><A
HREF="release.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="60%"
ALIGN="center"
VALIGN="bottom"
>Appendix E. Release Notes</TD
><TD
WIDTH="20%"
ALIGN="right"
VALIGN="top"
><A
TITLE="Release 8.0.7"
HREF="release-8-0-7.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="RELEASE-8-0-8"
>E.193. Release 8.0.8</A
></H1
><DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Release Date: </B
>2006-05-23</P
></BLOCKQUOTE
></DIV
><P
>   This release contains a variety of fixes from 8.0.7,
   including patches for extremely serious security issues.
   For information about new features in the 8.0 major release, see
   <A
HREF="release-8-0.html"
>Section E.201</A
>.
  </P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN144868"
>E.193.1. Migration to Version 8.0.8</A
></H2
><P
>    A dump/restore is not required for those running 8.0.X.  However,
    if you are upgrading from a version earlier than 8.0.6,
    see <A
HREF="release-8-0-6.html"
>Section E.195</A
>.
   </P
><P
>    Full security against the SQL-injection attacks described in
    CVE-2006-2313 and CVE-2006-2314 might require changes in application
    code.  If you have applications that embed untrustworthy strings
    into SQL commands, you should examine them as soon as possible to
    ensure that they are using recommended escaping techniques.  In
    most cases, applications should be using subroutines provided by
    libraries or drivers (such as <SPAN
CLASS="APPLICATION"
>libpq</SPAN
>'s
    <CODE
CLASS="FUNCTION"
>PQescapeStringConn()</CODE
>) to perform string escaping,
    rather than relying on <I
CLASS="FOREIGNPHRASE"
>ad hoc</I
> code to do it.
   </P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN144876"
>E.193.2. Changes</A
></H2
><P
></P
><UL
><LI
><P
>Change the server to reject invalidly-encoded multibyte
characters in all cases (Tatsuo, Tom)</P
><P
>While <SPAN
CLASS="PRODUCTNAME"
>PostgreSQL</SPAN
> has been moving in this direction for
some time, the checks are now applied uniformly to all encodings and all
textual input, and are now always errors not merely warnings.  This change
defends against SQL-injection attacks of the type described in CVE-2006-2313.</P
></LI
><LI
><P
>Reject unsafe uses of <TT
CLASS="LITERAL"
>\'</TT
> in string literals</P
><P
>As a server-side defense against SQL-injection attacks of the type
described in CVE-2006-2314, the server now only accepts <TT
CLASS="LITERAL"
>''</TT
> and not
<TT
CLASS="LITERAL"
>\'</TT
> as a representation of ASCII single quote in SQL string
literals.  By default, <TT
CLASS="LITERAL"
>\'</TT
> is rejected only when
<TT
CLASS="VARNAME"
>client_encoding</TT
> is set to a client-only encoding (SJIS, BIG5, GBK,
GB18030, or UHC), which is the scenario in which SQL injection is possible.
A new configuration parameter <TT
CLASS="VARNAME"
>backslash_quote</TT
> is available to
adjust this behavior when needed.  Note that full security against
CVE-2006-2314 might require client-side changes; the purpose of
<TT
CLASS="VARNAME"
>backslash_quote</TT
> is in part to make it obvious that insecure
clients are insecure.</P
></LI
><LI
><P
>Modify <SPAN
CLASS="APPLICATION"
>libpq</SPAN
>'s string-escaping routines to be
aware of encoding considerations and
<TT
CLASS="VARNAME"
>standard_conforming_strings</TT
></P
><P
>This fixes <SPAN
CLASS="APPLICATION"
>libpq</SPAN
>-using applications for the security
issues described in CVE-2006-2313 and CVE-2006-2314, and also future-proofs
them against the planned changeover to SQL-standard string literal syntax.
Applications that use multiple <SPAN
CLASS="PRODUCTNAME"
>PostgreSQL</SPAN
> connections
concurrently should migrate to <CODE
CLASS="FUNCTION"
>PQescapeStringConn()</CODE
> and
<CODE
CLASS="FUNCTION"
>PQescapeByteaConn()</CODE
> to ensure that escaping is done correctly
for the settings in use in each database connection.  Applications that
do string escaping <SPAN
CLASS="QUOTE"
>"by hand"</SPAN
> should be modified to rely on library
routines instead.</P
></LI
><LI
><P
>Fix some incorrect encoding conversion functions</P
><P
><CODE
CLASS="FUNCTION"
>win1251_to_iso</CODE
>, <CODE
CLASS="FUNCTION"
>alt_to_iso</CODE
>,
<CODE
CLASS="FUNCTION"
>euc_tw_to_big5</CODE
>, <CODE
CLASS="FUNCTION"
>euc_tw_to_mic</CODE
>,
<CODE
CLASS="FUNCTION"
>mic_to_euc_tw</CODE
> were all broken to varying
extents.</P
></LI
><LI
><P
>Clean up stray remaining uses of <TT
CLASS="LITERAL"
>\'</TT
> in strings
(Bruce, Jan)</P
></LI
><LI
><P
>Fix bug that sometimes caused OR'd index scans to
miss rows they should have returned</P
></LI
><LI
><P
>Fix WAL replay for case where a btree index has been
truncated</P
></LI
><LI
><P
>Fix <TT
CLASS="LITERAL"
>SIMILAR TO</TT
> for patterns involving
<TT
CLASS="LITERAL"
>|</TT
> (Tom)</P
></LI
><LI
><P
>Fix <TT
CLASS="COMMAND"
>SELECT INTO</TT
> and <TT
CLASS="COMMAND"
>CREATE TABLE AS</TT
> to
create tables in the default tablespace, not the base directory (Kris
Jurka)</P
></LI
><LI
><P
>Fix server to use custom DH SSL parameters correctly (Michael
Fuhr)</P
></LI
><LI
><P
>Fix for Bonjour on Intel Macs (Ashley Clark)</P
></LI
><LI
><P
>Fix various minor memory leaks</P
></LI
><LI
><P
>Fix problem with password prompting on some Win32 systems
(Robert Kinberg)</P
></LI
></UL
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="release-8-0-9.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="release-8-0-7.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Release 8.0.9</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="release.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Release 8.0.7</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>