## E.93. Release 9.2.22

Release date: 2017-08-10

This release contains a variety of fixes from 9.2.21. For information about new features in the 9.2 major release, see Section E.115.

The PostgreSQL community will stop releasing updates for the 9.2.X release series in September 2017. Users are encouraged to update to a newer release branch soon.

### E.93.1. Migration to Version 9.2.22

A dump/restore is not required for those running 9.2.X.

However, if you use foreign data servers that make use of user passwords for authentication, see the first changelog entry below.

Also, if you are upgrading from a version earlier than 9.2.20, see Section E.95.

### E.93.2. Changes

- Further restrict visibility of `pg_user_mappings`.`umoptions`, to protect passwords stored as user mapping options (Noah Misch)

  The fix for CVE-2017-7486 was incorrect: it allowed a user to see the options in her own user mapping, even if she did not have `USAGE` permission on the associated foreign server. Such options might include a password that had been provided by the server owner rather than the user herself. Since `information_schema.user_mapping_options` does not show the options in such cases, `pg_user_mappings` should not either. (CVE-2017-7547)

  By itself, this patch will only fix the behavior in newly initdb'd databases. If you wish to apply this change in an existing database, you will need to do the following:

  1. Restart the postmaster after adding `allow_system_table_mods = true` to `postgresql.conf`. (In versions supporting `ALTER SYSTEM`, you can use that to make the configuration change, but you'll still need a restart.)

  2. In each database of the cluster, run the following commands as superuser:

         SET search_path = pg_catalog;
         CREATE OR REPLACE VIEW pg_user_mappings AS
             SELECT
                 U.oid       AS umid,
                 S.oid       AS srvid,
                 S.srvname   AS srvname,
                 U.umuser    AS umuser,
                 CASE WHEN U.umuser = 0 THEN
                     'public'
                 ELSE
                     A.rolname
                 END AS usename,
                 CASE WHEN (U.umuser <> 0 AND A.rolname = current_user
                              AND (pg_has_role(S.srvowner, 'USAGE')
                                   OR has_server_privilege(S.oid, 'USAGE')))
                             OR (U.umuser = 0 AND pg_has_role(S.srvowner, 'USAGE'))
                             OR (SELECT rolsuper FROM pg_authid WHERE rolname = current_user)
                             THEN U.umoptions
                          ELSE NULL END AS umoptions
             FROM pg_user_mapping U
                  LEFT JOIN pg_authid A ON (A.oid = U.umuser) JOIN
                 pg_foreign_server S ON (U.umserver = S.oid);

  3. Do not forget to include the `template0` and `template1` databases, or the vulnerability will still exist in databases you create later. To fix `template0`, you'll need to temporarily make it accept connections. In PostgreSQL 9.5 and later, you can use

         ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;

     and then after fixing `template0`, undo that with

         ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;

     In prior versions, instead use

         UPDATE pg_database SET datallowconn = true WHERE datname = 'template0';
         UPDATE pg_database SET datallowconn = false WHERE datname = 'template0';

  4. Finally, remove the `allow_system_table_mods` configuration setting, and again restart the postmaster.

- Disallow empty passwords in all password-based authentication methods (Heikki Linnakangas)

  libpq ignores empty password specifications, and does not transmit them to the server. So, if a user's password has been set to the empty string, it's impossible to log in with that password via psql or other libpq-based clients. An administrator might therefore believe that setting the password to empty is equivalent to disabling password login. However, with a modified or non-libpq-based client, logging in could be possible, depending on which authentication method is configured. In particular the most common method, `md5`, accepted empty passwords. Change the server to reject empty passwords in all cases. (CVE-2017-7546)

- On Windows, retry process creation if we fail to reserve the address range for our shared memory in the new process (Tom Lane, Amit Kapila)

  This is expected to fix infrequent child-process-launch failures that are probably due to interference from antivirus products.

- Fix low-probability corruption of shared predicate-lock hash table in Windows builds (Thomas Munro, Tom Lane)

- Avoid logging clean closure of an SSL connection as though it were a connection reset (Michael Paquier)

- Prevent sending SSL session tickets to clients (Tom Lane)

  This fix prevents reconnection failures with ticket-aware client-side SSL code.

- Fix code for setting tcp_keepalives_idle on Solaris (Tom Lane)

- Fix statistics collector to honor inquiry messages issued just after a postmaster shutdown and immediate restart (Tom Lane)

  Statistics inquiries issued within half a second of the previous postmaster shutdown were effectively ignored.

- Ensure that the statistics collector's receive buffer size is at least 100KB (Tom Lane)

  This reduces the risk of dropped statistics data on older platforms whose default receive buffer size is less than that.

- Fix possible creation of an invalid WAL segment when a standby is promoted just after it processes an `XLOG_SWITCH` WAL record (Andres Freund)

- Fix SIGHUP and SIGUSR1 handling in walsender processes (Petr Jelinek, Andres Freund)

- Fix unnecessarily slow restarts of walreceiver processes due to race condition in postmaster (Tom Lane)

- Fix cases where an `INSERT` or `UPDATE` assigns to more than one element of a column that is of domain-over-array type (Tom Lane)

- Move autogenerated array types out of the way during `ALTER ... RENAME` (Vik Fearing)

  Previously, we would rename a conflicting autogenerated array type out of the way during `CREATE`; this fix extends that behavior to renaming operations.

- Ensure that `ALTER USER ... SET` accepts all the syntax variants that `ALTER ROLE ... SET` does (Peter Eisentraut)

- Properly update dependency info when changing a datatype I/O function's argument or return type from `opaque` to the correct type (Heikki Linnakangas)

  `CREATE TYPE` updates I/O functions declared in this long-obsolete style, but it forgot to record a dependency on the type, allowing a subsequent `DROP TYPE` to leave broken function definitions behind.

- Reduce memory usage when `ANALYZE` processes a `tsvector` column (Heikki Linnakangas)

- Fix unnecessary precision loss and sloppy rounding when multiplying or dividing `money` values by integers or floats (Tom Lane)

- Tighten checks for whitespace in functions that parse identifiers, such as `regprocedurein()` (Tom Lane)

  Depending on the prevailing locale, these functions could misinterpret fragments of multibyte characters as whitespace.

- Use relevant `#define` symbols from Perl while compiling PL/Perl (Ashutosh Sharma, Tom Lane)

  This avoids portability problems, typically manifesting as a “handshake” mismatch during library load, when working with recent Perl versions.

- In psql, fix failure when `COPY FROM STDIN` is ended with a keyboard EOF signal and then another `COPY FROM STDIN` is attempted (Thomas Munro)

  This misbehavior was observed on BSD-derived platforms (including macOS), but not on most others.

- Fix pg_dump to not emit invalid SQL for an empty operator class (Daniel Gustafsson)

- Fix pg_dump output to stdout on Windows (Kuntal Ghosh)

  A compressed plain-text dump written to stdout would contain corrupt data due to failure to put the file descriptor into binary mode.

- Fix `pg_get_ruledef()` to print correct output for the `ON SELECT` rule of a view whose columns have been renamed (Tom Lane)

  In some corner cases, pg_dump relies on `pg_get_ruledef()` to dump views, so that this error could result in dump/reload failures.

- Fix dumping of function expressions in the `FROM` clause in cases where the expression does not deparse into something that looks like a function call (Tom Lane)

- Fix pg_basebackup output to stdout on Windows (Haribabu Kommi)

  A backup written to stdout would contain corrupt data due to failure to put the file descriptor into binary mode.

- Fix pg_upgrade to ensure that the ending WAL record does not have wal_level = `minimum` (Bruce Momjian)

  This condition could prevent upgraded standby servers from reconnecting.

- Always use `-fPIC`, not `-fpic`, when building shared libraries with gcc (Tom Lane)

  This supports larger extension libraries on platforms where it makes a difference.

- Fix unescaped-braces issue in our build scripts for Microsoft MSVC, to avoid a warning or error from recent Perl versions (Andrew Dunstan)

- In MSVC builds, handle the case where the openssl library is not within a `VC` subdirectory (Andrew Dunstan)

- In MSVC builds, add proper include path for libxml2 header files (Andrew Dunstan)

  This fixes a former need to move things around in standard Windows installations of libxml2.

- In MSVC builds, recognize a Tcl library that is named `tcl86.lib` (Noah Misch)