Update release notes for security releases.

Security: CVE-2007-4769, CVE-2007-4772, CVE-2007-6067, CVE-2007-6600, CVE-2007-6601

doc/src/sgml/release.sgml

@@ -1,4 +1,4 @@
-<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.163.2.47 2007/09/16 03:04:09 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.163.2.48 2008/01/03 21:36:29 tgl Exp $ -->
 <!--
 
 Typical markup:
@@ -26,7 +26,7 @@ non-ASCII characters            convert to HTML4 entity (&) escapes
 wrap long lines
 
 For new features, add links to the documentation sections.  Use </link>
-so that perl can remove it so HISTORY.html can be created with no
+so that Perl can remove it so HISTORY.html can be created with no
 links to the main documentation.  This was added only in 8.2, so don't
 do it for earlier branch release files.
 
@@ -35,6 +35,118 @@ do it for earlier branch release files.
 <appendix id="release">
  <title>Release Notes</title>
 
+ <sect1 id="release-7-3-21">
+  <title>Release 7.3.21</title>
+
+  <note>
+  <title>Release date</title>
+  <simpara>2008-01-07</simpara>
+  </note>
+
+  <para>
+   This release contains a variety of fixes from 7.3.20,
+   including fixes for significant security issues.
+  </para>
+
+  <para>
+   This is expected to be the last <productname>PostgreSQL</> release
+   in the 7.3.X series.  Users are encouraged to update to a newer
+   release branch soon.
+  </para>
+
+  <sect2>
+   <title>Migration to Version 7.3.21</title>
+
+   <para>
+    A dump/restore is not required for those running 7.3.X.  However,
+    if you are upgrading from a version earlier than 7.3.13, see the release
+    notes for 7.3.13.
+   </para>
+
+  </sect2>
+
+  <sect2>
+   <title>Changes</title>
+
+   <itemizedlist>
+
+    <listitem>
+     <para>
+      Prevent functions in indexes from executing with the privileges of
+      the user running <command>VACUUM</>, <command>ANALYZE</>, etc (Tom)
+     </para>
+
+     <para>
+      Functions used in index expressions and partial-index
+      predicates are evaluated whenever a new table entry is made.  It has
+      long been understood that this poses a risk of trojan-horse code
+      execution if one modifies a table owned by an untrustworthy user.
+      (Note that triggers, defaults, check constraints, etc. pose the
+      same type of risk.)  But functions in indexes pose extra danger
+      because they will be executed by routine maintenance operations
+      such as <command>VACUUM FULL</>, which are commonly performed
+      automatically under a superuser account.  For example, a nefarious user
+      can execute code with superuser privileges by setting up a
+      trojan-horse index definition and waiting for the next routine vacuum.
+      The fix arranges for standard maintenance operations
+      (including <command>VACUUM</>, <command>ANALYZE</>, <command>REINDEX</>,
+      and <command>CLUSTER</>) to execute as the table owner rather than
+      the calling user, using the same privilege-switching mechanism already
+      used for <literal>SECURITY DEFINER</> functions.  To prevent bypassing
+      this security measure, execution of <command>SET SESSION
+      AUTHORIZATION</> and <command>SET ROLE</> is now forbidden within a
+      <literal>SECURITY DEFINER</> context.  (CVE-2007-6600)
+     </para>
+    </listitem>
+
+    <listitem>
+     <para>
+      Require non-superusers who use <filename>/contrib/dblink</> to use only
+      password authentication, as a security measure (Joe)
+     </para>
+
+     <para>
+      The fix that appeared for this in 7.3.20 was incomplete, as it plugged
+      the hole for only some <filename>dblink</> functions.  (CVE-2007-6601,
+      CVE-2007-3278)
+     </para>
+    </listitem>
+
+    <listitem>
+     <para>
+      Fix potential crash in <function>translate()</> when using a multibyte
+      database encoding (Tom)
+     </para>
+    </listitem>
+
+    <listitem>
+     <para>
+      Make <filename>contrib/tablefunc</>'s <function>crosstab()</> handle
+      NULL rowid as a category in its own right, rather than crashing (Joe)
+     </para>
+    </listitem>
+
+    <listitem>
+     <para>
+      Require a specific version of <productname>Autoconf</> to be used
+      when re-generating the <command>configure</> script (Peter)
+     </para>
+
+     <para>
+      This affects developers and packagers only.  The change was made
+      to prevent accidental use of untested combinations of
+      <productname>Autoconf</> and <productname>PostgreSQL</> versions.
+      You can remove the version check if you really want to use a
+      different <productname>Autoconf</> version, but it's
+      your responsibility whether the result works or not.
+     </para>
+    </listitem>
+
+   </itemizedlist>
+
+  </sect2>
+ </sect1>
+
  <sect1 id="release-7-3-20">
   <title>Release 7.3.20</title>
 
@@ -48,7 +160,7 @@ do it for earlier branch release files.
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.20</title>
+   <title>Migration to Version 7.3.20</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -110,7 +222,7 @@ do it for earlier branch release files.
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.19</title>
+   <title>Migration to Version 7.3.19</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -166,7 +278,7 @@ do it for earlier branch release files.
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.18</title>
+   <title>Migration to Version 7.3.18</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -227,7 +339,7 @@ do it for earlier branch release files.
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.17</title>
+   <title>Migration to Version 7.3.17</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -283,7 +395,7 @@ do it for earlier branch release files.
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.16</title>
+   <title>Migration to Version 7.3.16</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -326,7 +438,7 @@ do it for earlier branch release files.
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.15</title>
+   <title>Migration to Version 7.3.15</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -417,7 +529,7 @@ Fuhr)</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.14</title>
+   <title>Migration to Version 7.3.14</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -474,7 +586,7 @@ and <function>isinf</> during configure (Tom)</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.13</title>
+   <title>Migration to Version 7.3.13</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -536,7 +648,7 @@ what's actually returned by the query (Joe)</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.12</title>
+   <title>Migration to Version 7.3.12</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -583,7 +695,7 @@ table has been dropped</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.11</title>
+   <title>Migration to Version 7.3.11</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -635,7 +747,7 @@ the variable is of pass-by-reference type</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.10</title>
+   <title>Migration to Version 7.3.10</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.  However,
@@ -761,7 +873,7 @@ month-related formats</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.3.9</title>
+   <title>Migration to Version 7.3.9</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.
@@ -817,7 +929,7 @@ datestyles</para></listitem>
 
 
   <sect2>
-    <title>Migration to version 7.3.8</title>
+   <title>Migration to Version 7.3.8</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.
@@ -867,7 +979,7 @@ concern since there is no reason for non-developers to use this script anyway.
 
 
   <sect2>
-    <title>Migration to version 7.3.7</title>
+   <title>Migration to Version 7.3.7</title>
 
    <para>
     A dump/restore is not required for those running 7.3.X.
@@ -907,7 +1019,7 @@ since <productname>PostgreSQL</productname> 7.1.
 
 
   <sect2>
-    <title>Migration to version 7.3.6</title>
+   <title>Migration to Version 7.3.6</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those
@@ -972,7 +1084,7 @@ operations on bytea columns (Joe)</para></listitem>
 
 
   <sect2>
-    <title>Migration to version 7.3.5</title>
+   <title>Migration to Version 7.3.5</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those
@@ -1023,7 +1135,7 @@ operations on bytea columns (Joe)</para></listitem>
 
 
   <sect2>
-    <title>Migration to version 7.3.4</title>
+   <title>Migration to Version 7.3.4</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those
@@ -1062,7 +1174,7 @@ operations on bytea columns (Joe)</para></listitem>
  </para>
 
  <sect2>
-   <title>Migration to version 7.3.3</title>
+  <title>Migration to Version 7.3.3</title>
 
   <para>
    A dump/restore is <emphasis>not</emphasis> required for those
@@ -1173,7 +1285,7 @@ operations on bytea columns (Joe)</para></listitem>
 
 
  <sect2>
-   <title>Migration to version 7.3.2</title>
+  <title>Migration to Version 7.3.2</title>
 
   <para>
    A dump/restore is <emphasis>not</emphasis> required for those
@@ -1234,7 +1346,7 @@ operations on bytea columns (Joe)</para></listitem>
 
 
  <sect2>
-   <title>Migration to version 7.3.1</title>
+  <title>Migration to Version 7.3.1</title>
 
   <para>
    A dump/restore is <emphasis>not</emphasis> required for those
@@ -1403,7 +1515,7 @@ operations on bytea columns (Joe)</para></listitem>
  </sect2>
 
  <sect2>
-   <title>Migration to version 7.3</title>
+  <title>Migration to Version 7.3</title>
 
   <para>
    A dump/restore using <application>pg_dump</> is required for those
@@ -1920,7 +2032,7 @@ operations on bytea columns (Joe)</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.2.8</title>
+   <title>Migration to Version 7.2.8</title>
 
    <para>
     A dump/restore is not required for those running 7.2.X.
@@ -1971,7 +2083,7 @@ month-related formats</para></listitem>
   </para>
 
   <sect2>
-    <title>Migration to version 7.2.7</title>
+   <title>Migration to Version 7.2.7</title>
 
    <para>
     A dump/restore is not required for those running 7.2.X.
@@ -2019,7 +2131,7 @@ datestyles</para></listitem>
 
 
   <sect2>
-    <title>Migration to version 7.2.6</title>
+   <title>Migration to Version 7.2.6</title>
 
    <para>
     A dump/restore is not required for those running 7.2.X.
@@ -2070,7 +2182,7 @@ concern since there is no reason for non-developers to use this script anyway.
 
 
   <sect2>
-    <title>Migration to version 7.2.5</title>
+   <title>Migration to Version 7.2.5</title>
 
    <para>
     A dump/restore is not required for those running 7.2.X.
@@ -2113,7 +2225,7 @@ since <productname>PostgreSQL</productname> 7.1.
  </para>
 
  <sect2>
-   <title>Migration to version 7.2.4</title>
+  <title>Migration to Version 7.2.4</title>
 
   <para>
    A dump/restore is <emphasis>not</emphasis> required for those
@@ -2152,7 +2264,7 @@ since <productname>PostgreSQL</productname> 7.1.
  </para>
 
  <sect2>
-   <title>Migration to version 7.2.3</title>
+  <title>Migration to Version 7.2.3</title>
 
   <para>
    A dump/restore is <emphasis>not</emphasis> required for those
@@ -2188,7 +2300,7 @@ since <productname>PostgreSQL</productname> 7.1.
  </para>
 
  <sect2>
-   <title>Migration to version 7.2.2</title>
+  <title>Migration to Version 7.2.2</title>
 
   <para>
    A dump/restore is <emphasis>not</emphasis> required for those
@@ -2231,7 +2343,7 @@ since <productname>PostgreSQL</productname> 7.1.
  </para>
 
  <sect2>
-   <title>Migration to version 7.2.1</title>
+  <title>Migration to Version 7.2.1</title>
 
   <para>
    A dump/restore is <emphasis>not</emphasis> required for those
@@ -2362,7 +2474,7 @@ since <productname>PostgreSQL</productname> 7.1.
  </sect2>
 
  <sect2>
-   <title>Migration to version 7.2</title>
+  <title>Migration to Version 7.2</title>
 
   <para>
    A dump/restore using <command>pg_dump</command> is required for
@@ -2829,7 +2941,7 @@ since <productname>PostgreSQL</productname> 7.1.
   </note>
 
   <sect2>
-    <title>Migration to version 7.1.3</title>
+   <title>Migration to Version 7.1.3</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -2872,7 +2984,7 @@ Cygwin build (Jason Tishler)
 
 
   <sect2>
-    <title>Migration to version 7.1.2</title>
+   <title>Migration to Version 7.1.2</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -2910,7 +3022,7 @@ pg_dump cleanups
 
 
   <sect2>
-    <title>Migration to version 7.1.1</title>
+   <title>Migration to Version 7.1.1</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -3037,7 +3149,7 @@ Subqueries in FROM are now supported.
   </variablelist>
 
   <sect2>
-    <title>Migration to version 7.1</title>
+   <title>Migration to Version 7.1</title>
 
    <para>
        A dump/restore using pg_dump is required for those wishing to migrate
@@ -3255,7 +3367,7 @@ New FreeBSD tools ipc_check, start-scripts/freebsd
 
 
   <sect2>
-    <title>Migration to version 7.0.3</title>
+   <title>Migration to Version 7.0.3</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -3327,7 +3439,7 @@ Fix for crash of backend, on abort (Tom)
 
 
   <sect2>
-    <title>Migration to version 7.0.2</title>
+   <title>Migration to Version 7.0.2</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -3360,7 +3472,7 @@ Added documentation to tarball.
   </para>
 
   <sect2>
-    <title>Migration to version 7.0.1</title>
+   <title>Migration to Version 7.0.1</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -3395,7 +3507,7 @@ Copy pg_ident.conf.sample into /lib directory in install (Bruce)
 Add SJIS UDC (NEC selection IBM kanji) support (Eiji Tokuya)
 Fix too long syslog message (Tatsuo)
 Fix problem with quoted indexes that are too long (Tom)
-JDBC ResultSet.getTimestamp() fix (Gregory Krasnow & Floyd Marinescu)
+JDBC ResultSet.getTimestamp() fix (Gregory Krasnow &amp; Floyd Marinescu)
 ecpg changes (Michael)
     </programlisting>
    </para>
@@ -3480,7 +3592,7 @@ ecpg changes (Michael)
   </variablelist>
 
   <sect2>
-    <title>Migration to version 7.0</title>
+   <title>Migration to Version 7.0</title>
 
    <para>
     A dump/restore using <application>pg_dump</application>
@@ -3886,7 +3998,7 @@ New multibyte encodings
 
 
   <sect2>
-    <title>Migration to version 6.5.3</title>
+   <title>Migration to Version 6.5.3</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -3922,7 +4034,7 @@ Fix dumping rules on inherited tables
 
 
   <sect2>
-    <title>Migration to version 6.5.2</title>
+   <title>Migration to Version 6.5.2</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -3978,7 +4090,7 @@ Updated version of pgaccess 0.98
   </para>
 
   <sect2>
-    <title>Migration to version 6.5.1</title>
+   <title>Migration to Version 6.5.1</title>
 
    <para>
     A dump/restore is <emphasis>not</emphasis> required for those running
@@ -4177,7 +4289,7 @@ Add Win1250 (Czech) support (Pavel Behal)
   </para>
 
   <sect2>
-    <title>Migration to version 6.5</title>
+   <title>Migration to Version 6.5</title>
 
    <para>
     A dump/restore using <application>pg_dump</application>
@@ -4434,7 +4546,7 @@ bug fix.
 
 
 <sect2>
-<title>Migration to version 6.4.2</title>
+<title>Migration to Version 6.4.2</title>
 
 <para>
 A dump/restore is <emphasis>not</emphasis> required for those running
@@ -4469,7 +4581,7 @@ problems reported by 6.4 users.
 
 
 <sect2>
-<title>Migration to version 6.4.1</title>
+<title>Migration to Version 6.4.1</title>
 
 <para>
 A dump/restore is <emphasis>not</emphasis> required for those running
@@ -4603,7 +4715,7 @@ been.
 </para>
 
 <sect2>
-<title>Migration to version 6.4</title>
+<title>Migration to Version 6.4</title>
 
 <para>
 A dump/restore using <application>pg_dump</application>
@@ -5099,7 +5211,7 @@ Better identify tcl and tk libs and includes(Bruce)
   </para>
 
   <sect2>
-    <title>Migration to version 6.3</title>
+   <title>Migration to Version 6.3</title>
 
    <para>
     A dump/restore using <application>pg_dump</application>
@@ -5247,7 +5359,7 @@ Source Tree Changes
 Add new html development tools, and flow chart in /tools/backend
 Fix for SCO compiles
 Stratus computer port Robert Gillies
-Added support for shlib for BSD44_derived & i386_solaris
+Added support for shlib for BSD44_derived &amp; i386_solaris
 Make configure more automated(Brook)
 Add script to check regression test results
 Break parser functions into smaller files, group together(Bruce)
@@ -5433,7 +5545,7 @@ Enhancements
 ------------
 Default genetic optimizer GEQO parameter is now 8(Bruce)
 Allow use parameters in target list having aggregates in functions(Vadim)
-Added JDBC driver as an interface(Adrian & Peter)
+Added JDBC driver as an interface(Adrian &amp; Peter)
 pg_password utility
 Return number of rows inserted/affected by INSERT/UPDATE/DELETE etc.(Vadim)
 Triggers implemented with CREATE TRIGGER (SQL3)(Vadim)
@@ -5444,7 +5556,7 @@ Include reserved words for string handling, outer joins, and unions(Thomas)
 Implement extended comments ("/* ... */") using exclusive states(Thomas)
 Add "//" single-line comments(Bruce)
 Remove some restrictions on characters in operator names(Thomas)
-DEFAULT and CONSTRAINT for tables implemented (SQL92)(Vadim & Thomas)
+DEFAULT and CONSTRAINT for tables implemented (SQL92)(Vadim &amp; Thomas)
 Add text concatenation operator and function (SQL92)(Thomas)
 Support WITH TIME ZONE syntax (SQL92)(Thomas)
 Support INTERVAL unit TO unit syntax (SQL92)(Thomas)
@@ -5466,7 +5578,7 @@ Replace distance operator "&lt;===&gt;" with "&lt;-&gt;"(Thomas)
 Replace "above" operator "!^" with "&gt;^" and "below" operator "!|" with "&lt;^"(Thomas)
 Add routines for text trimming on both ends, substring, and string position(Thomas)
 Added conversion routines circle(box) and poly(circle)(Thomas)
-Allow internal sorts to be stored in memory rather than in files(Bruce & Vadim)
+Allow internal sorts to be stored in memory rather than in files(Bruce &amp; Vadim)
 Allow functions and operators on internally-identical types to succeed(Bruce)
 Speed up backend start-up after profiling analysis(Bruce)
 Inline frequently called functions for performance(Bruce)
@@ -5499,7 +5611,7 @@ new interfaces directory(Marc)
 Replace fopen() calls with calls to fd.c functions(Bruce)
 Make functions static where possible(Bruce)
 enclose unused functions in #ifdef NOT_USED(Bruce)
-Remove call to difftime() in timestamp support to fix SunOS(Bruce & Thomas)
+Remove call to difftime() in timestamp support to fix SunOS(Bruce &amp; Thomas)
 Changes for Digital Unix
 Portability fix for pg_dumpall(Bruce)
 Rename pg_attribute.attnvals to attdispersion(Bruce)
@@ -5507,12 +5619,12 @@ Rename pg_attribute.attnvals to attdispersion(Bruce)
 "built-in" manual page now "pgbuiltin"(Bruce)
 "drop" manual page now "drop_table"(Bruce)
 Add "create_trigger", "drop_trigger" manual pages(Thomas)
-Add constraints regression test(Vadim & Thomas)
+Add constraints regression test(Vadim &amp; Thomas)
 Add comments syntax regression test(Thomas)
 Add PGINDENT and support program(Bruce)
 Massive commit to run PGINDENT on all *.c and *.h files(Bruce)
 Files moved to /src/tools directory(Bruce)
-SPI and Trigger programming guides (Vadim & D'Arcy)
+SPI and Trigger programming guides (Vadim &amp; D'Arcy)
 </programlisting>
 </para>
 </sect2>
@@ -5619,7 +5731,7 @@ optimizer which uses <firstterm>genetic</firstterm>
 </para>
 
 <sect2>
-<title>Migration to version 6.1</title>
+<title>Migration to Version 6.1</title>
 
 <para>
 This migration requires a complete dump of the 6.0 database and a
@@ -5819,7 +5931,7 @@ Allow libpq to distinguish between text value '' and null(Bruce)
 Allow non-postgres users with createdb privs to destroydb's
 Allow restriction on who can create C functions(Bryan)
 Allow restriction on who can do backend COPY(Bryan)
-Can shrink tables, pg_time and pg_log(Vadim & Erich)
+Can shrink tables, pg_time and pg_log(Vadim &amp; Erich)
 Change debug level 2 to print queries only, changed debug heading layout(Bruce)
 Change default decimal constant representation from float4 to float8(Bruce)
 European date format now set when postmaster is started