introduction to Python Software Foundation Noah Chen https://fossasia.org/ Thank You all staff/volunteer/speakers/sponsors/participants in PyCon China 2019 Noah Chen outreach manager and volunteer of

Konstantin Knizhnik) • Randomize the random() seed in bootstrap and standalone backends, and in initdb (Noah Misch) The main practical effect of this change is that it avoids a scenario where initdb might mistakenly installations and applications to guard against search-path-dependent trojan-horse attacks from other users (Noah Misch) Using a search_path setting that includes any schemas writable by a hostile user enables that (CVE-2018-1058) • Avoid use of insecure search_path settings in pg_dump and other client programs (Noah Misch, Tom Lane) pg_dump, pg_upgrade, vacuumdb and other PostgreSQL-provided applications were themselves

Konstantin Knizhnik) • Randomize the random() seed in bootstrap and standalone backends, and in initdb (Noah Misch) The main practical effect of this change is that it avoids a scenario where initdb might mistakenly installations and applications to guard against search-path-dependent trojan-horse attacks from other users (Noah Misch) Using a search_path setting that includes any schemas writable by a hostile user enables that (CVE-2018-1058) • Avoid use of insecure search_path settings in pg_dump and other client programs (Noah Misch, Tom Lane) pg_dump, pg_upgrade, vacuumdb and other PostgreSQL-provided applications were themselves

Section E.3. E.1.2. Changes • Fix sample server-start scripts to become $PGUSER before opening $PGLOG (Noah Misch) Previously, the postmaster log file was opened while still running as root. The database owner restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user mapping options (Noah Misch) The fix for CVE-2017-7486 was incorrect: it allowed a user to see the options in her own user Windows installations of libxml2. • In MSVC builds, recognize a Tcl library that is named tcl86.lib (Noah Misch) E.4. Release 9.2.21 Release date: 2017-05-11 This release contains a variety of fixes from

Section E.3. E.1.2. Changes • Fix sample server-start scripts to become $PGUSER before opening $PGLOG (Noah Misch) Previously, the postmaster log file was opened while still running as root. The database owner restrict visibility of pg_user_mappings.umoptions, to protect passwords stored as user map- ping options (Noah Misch) The fix for CVE-2017-7486 was incorrect: it allowed a user to see the options in her own user Windows installations of libxml2. • In MSVC builds, recognize a Tcl library that is named tcl86.lib (Noah Misch) E.4. Release 9.2.21 Release date: 2017-05-11 This release contains a variety of fixes from

(CVE-2016-5423) • Fix client programs’ handling of special characters in database and role names (Noah Misch, Nathan Bossart, Michael Paquier) Numerous places in vacuumdb and other client programs could the old way. • Fix makefiles’ rule for building AIX shared libraries to be safe for parallel make (Noah Misch) • Fix TAP tests and MSVC scripts to work when build directory’s path name contains spaces wait timeout from the PGCTLTIMEOUT environment variable, if none is spec- ified on the command line (Noah Misch) This eases testing of slower buildfarm members by allowing them to globally specify a longer-than-

(CVE-2016-5423) • Fix client programs’ handling of special characters in database and role names (Noah Misch, Nathan Bossart, Michael Paquier) Numerous places in vacuumdb and other client programs could the old way. • Fix makefiles’ rule for building AIX shared libraries to be safe for parallel make (Noah Misch) • Fix TAP tests and MSVC scripts to work when build directory’s path name contains spaces wait timeout from the PGCTLTIMEOUT environment variable, if none is specified on the command line (Noah Misch) 1980 Appendix E. Release Notes This eases testing of slower buildfarm members by allowing

could fail if the user sets CFLAGS to -O0. • Ensure correct code generation for spinlocks on PowerPC (Noah Misch) The previous spinlock coding allowed the compiler to select register zero for use with an PostgreSQL code or use atypical compiler options. • On AIX, don’t use the compiler option -qsrcmsg (Noah Misch) This avoids an internal compiler error with xlc v16.1.0, with little consequence other than Changes • Require schema qualification to cast to a temporary type when using functional cast syntax (Noah Misch) We have long required invocations of temporary functions to explicitly specify the temporary

could fail if the user sets CFLAGS to -O0. • Ensure correct code generation for spinlocks on PowerPC (Noah Misch) The previous spinlock coding allowed the compiler to select register zero for use with an PostgreSQL code or use atypical compiler options. • On AIX, don’t use the compiler option -qsrcmsg (Noah Misch) This avoids an internal compiler error with xlc v16.1.0, with little consequence other than Changes • Require schema qualification to cast to a temporary type when using functional cast syntax (Noah Misch) We have long required invocations of temporary functions to explicitly specify the temporary

self” errors or unique-constraint violations. • Flush ACL-related caches when pg_authid changes (Noah Misch) This change ensures that permissions-related decisions will promptly reflect the results of expressions. • Prevent possible data loss from incorrect detection of the wraparound point of an SLRU log (Noah Misch) The wraparound point typically falls in the middle of a page, which must be rounded off to WITH HOLD and firing of deferred triggers within index expres- sions and materialized view queries (Noah Misch) 2205 Appendix E. Release Notes This is essentially a leak in the “security restricted operation”