PostgreSQL 16.2 → 16.3

1 release · 2 breaking changes · 4 security fixes · 1 advisory fixed

4security2breaking1deprecated7feature25fix

Is 16.2 affected? · What changed up to 18.6

Vulnerabilities fixed by this upgrade

3.1 CVE-2024-4317 Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS co…

Breaking changes

breaking Avoid deadlock during removal of orphaned temporary tables (Mikhail Zhilin) If the session that creates a temporary table crashes without removing the table, autovacuum will eventually try to remove the orphaned table. However, an incoming session that's been assigned the same temporary namespace… in 16.3
breaking Fix incompatibility with LLVM 18 (Thomas Munro, Dmitry Dolgov) in 16.3

Security changes

security Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner (Nathan Bossart) These views failed to hide statistics for expressions that involve columns the accessing user does not have permission to read. View columns such as most_common_vals might expose… in 16.3
security Find the SQL script fix-CVE-2024-4317.sql in the share directory of the PostgreSQL installation (typically located someplace like /usr/share/postgresql/). Be sure to use the script appropriate to your PostgreSQL major version. If you do not see this file, either your version is not vulnerable… in 16.3
security In each database of the cluster, run the fix-CVE-2024-4317.sql script as superuser. In psql this would look like \i /usr/share/postgresql/fix-CVE-2024-4317.sql (adjust the file path as appropriate). Any error probably indicates that you've used the wrong script version. It will not hurt to run the… in 16.3
security Do not forget to include the template0 and template1 databases, or the vulnerability will still exist in databases you create later. To fix template0, you'll need to temporarily make it accept connections. Do that with ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true; and then after fixing… in 16.3

Deprecations

deprecated In contrib/xml2, avoid use of library functions that have been deprecated in recent versions of libxml2 (Dmitry Koval) in 16.3

Every release in between

16.3 May 9, 2024 Release notes ↗

securityRestrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner (Nathan Bossart) These views failed to hide statistics for expressions that involve columns the accessing user does not have permission to read. View columns such as most_common_vals might expose…

securityFind the SQL script fix-CVE-2024-4317.sql in the share directory of the PostgreSQL installation (typically located someplace like /usr/share/postgresql/). Be sure to use the script appropriate to your PostgreSQL major version. If you do not see this file, either your version is not vulnerable…

securityIn each database of the cluster, run the fix-CVE-2024-4317.sql script as superuser. In psql this would look like \i /usr/share/postgresql/fix-CVE-2024-4317.sql (adjust the file path as appropriate). Any error probably indicates that you've used the wrong script version. It will not hurt to run the…

securityDo not forget to include the template0 and template1 databases, or the vulnerability will still exist in databases you create later. To fix template0, you'll need to temporarily make it accept connections. Do that with ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true; and then after fixing…

fixFix INSERT from multiple VALUES rows into a target column that is a domain over an array or composite type (Tom Lane) Such cases would either fail with surprising complaints about mismatched datatypes, or insert unexpected coercions that could lead to odd results.

otherRequire SELECT privilege on the target table for MERGE with a DO NOTHING clause (Álvaro Herrera) SELECT privilege would be required in all practical cases anyway, but require it even if the query reads no columns of the target table. This avoids an edge case in which MERGE would require no…

fixFix handling of self-modified tuples in MERGE (Dean Rasheed) Throw an error if a target row joins to more than one source row, as required by the SQL standard. (The previous coding could silently ignore this condition if a concurrent update was involved.) Also, throw a non-misleading error if a…

fixFix incorrect pruning of NULL partition when a table is partitioned on a boolean column and the query has a boolean IS NOT clause (David Rowley) A NULL value satisfies a clause such as boolcol IS NOT FALSE, so pruning away a partition containing NULLs yielded incorrect answers.

featureMake ALTER FOREIGN TABLE SET SCHEMA move any owned sequences into the new schema (Tom Lane) Moving a regular table to a new schema causes any sequences owned by the table to be moved to that schema too (along with indexes and constraints). This was overlooked for foreign tables, however.

featureMake ALTER TABLE ... ADD COLUMN create identity/serial sequences with the same persistence as their owning tables (Peter Eisentraut) CREATE UNLOGGED TABLE will make any owned sequences be unlogged too. ALTER TABLE missed that consideration, so that an added identity column would have a logged…

fixFix EXPLAIN's counting of heap pages accessed by a bitmap heap scan (Melanie Plageman) Previously, heap pages that contain no visible tuples were not counted; but it seems more consistent to count all pages returned by the bitmap index scan.

fixFix EXPLAIN's output for subplans in MERGE (Dean Rasheed) EXPLAIN would sometimes fail to properly display subplan Params referencing variables in other parts of the plan tree.

breakingAvoid deadlock during removal of orphaned temporary tables (Mikhail Zhilin) If the session that creates a temporary table crashes without removing the table, autovacuum will eventually try to remove the orphaned table. However, an incoming session that's been assigned the same temporary namespace…

fixFix updating of visibility map state in VACUUM with the DISABLE_PAGE_SKIPPING option (Heikki Linnakangas) Due to an oversight, this mode caused all heap pages to be dirtied, resulting in excess I/O. Also, visibility map bits that were incorrectly set would not get cleared.

fixFix buffer usage reporting for parallel vacuuming (Anthonin Bonnefoy) Buffer accesses performed by parallel workers were not getting counted in the statistics reported in VERBOSE mode.

fixFix “could not find pathkey item to sort” errors occurring while planning aggregate functions with ORDER BY or DISTINCT options (David Rowley) This is similar to a fix applied in 16.1, but it solves the problem for parallel plans.

fixAvoid use of already-freed data while planning partition-wise joins under GEQO (Tom Lane) This would typically end in a crash or unexpected error message.

fixFix incorrectly-reported statistics kind codes in “requested statistics kind X is not yet built” error messages (David Rowley)

fixFix confusion about the return rowtype of SQL-language procedures (Tom Lane) A procedure implemented in SQL language that returns a single composite-type column would cause an assertion failure or core dump.

featureAdd protective stack depth checks to some recursive functions (Egor Chindyaskin)

fixFix mis-rounding and overflow hazards in date_bin() (Moaaz Assali) In the case where the source timestamp is before the origin timestamp and their difference is already an exact multiple of the stride, the code incorrectly subtracted the stride anyway. Also, detect some integer-overflow cases that…

fixFix detection of old transaction IDs in XID status functions (Karina Litskevich) Transaction IDs more than 231 transactions in the past could be misidentified as recent, leading to misbehavior of pg_xact_status() or txid_status().

fixEnsure that a table's freespace map won't return a page that's past the end of the table (Ronan Dunklau) Because the freespace map isn't WAL-logged, this was possible in edge cases involving an OS crash, a replica promote, or a PITR restore. The result would be a “could not read block” error.

fixFix file descriptor leakage when an error is thrown while waiting in WaitEventSetWait (Etsuro Fujita)

featureAvoid corrupting exception stack if an FDW implements async append but doesn't configure any wait conditions for the Append plan node to wait for (Alexander Pyhalov)

fixEnsure that index-only scans on name columns return a fully-padded value (David Rowley) The value physically stored in the index is truncated, and previously a pointer to that value was returned to callers. This provoked complaints when testing under valgrind. In theory it could result in crashes,…

fixFix race condition that could lead to reporting an incorrect conflict cause when invalidating a replication slot (Bertrand Drouvot)

fixFix race condition in deciding whether a table sync operation is needed in logical replication (Vignesh C) An invalidation event arriving while a subscriber identifies which tables need to be synced would be forgotten about, so that any tables newly in need of syncing might not get processed in a…

fixFix crash with DSM allocations larger than 4GB (Heikki Linnakangas)

featureDisconnect if a new server session's client socket cannot be put into non-blocking mode (Heikki Linnakangas) It was once theoretically possible for us to operate with a socket that's in blocking mode; but that hasn't worked fully in a long time, so fail at connection start rather than misbehave…

fixFix inadequate error reporting with OpenSSL 3.0.0 and later (Heikki Linnakangas, Tom Lane) System-reported errors passed through by OpenSSL were reported with a numeric error code rather than anything readable.

fixFix thread-safety of error reporting for getaddrinfo() on Windows (Thomas Munro) A multi-threaded libpq client program could get an incorrect or corrupted error message after a network lookup failure.

featureAvoid concurrent calls to bindtextdomain() in libpq and ecpglib (Tom Lane) Although GNU gettext's implementation seems to be fine with concurrent calls, the version available on Windows is not.

fixFix crash in ecpg's preprocessor if the program tries to redefine a macro that was defined on the preprocessor command line (Tom Lane)

fixFix pg_dumpall so that role comments, if present, will be dumped regardless of the setting of --no-role-passwords (Daniel Gustafsson, Álvaro Herrera)

fixFix PL/pgSQL's parsing of single-line comments (---style comments) following expressions (Erik Wienhold, Tom Lane) This mistake caused parse errors if such a comment followed a WHEN expression in a PL/pgSQL CASE statement.

fixFix bugs in BRIN output functions (Tomas Vondra) These output functions are only used for displaying index entries in contrib/pageinspect, so the errors are of limited practical concern.

deprecatedIn contrib/xml2, avoid use of library functions that have been deprecated in recent versions of libxml2 (Dmitry Koval)

breakingFix incompatibility with LLVM 18 (Thomas Munro, Dmitry Dolgov)

featureAllow make check to work with the musl C library (Thomas Munro, Bruce Momjian, Tom Lane)

+20 more items in the release notes