Last-minute updates for release notes.

Security: CVE-2020-25694, CVE-2020-25695, CVE-2020-25696

diff --git a/doc/src/sgml/release-13.sgml b/doc/src/sgml/release-13.sgml
index 635c5d813f63f29634e848387e2e15f20e52d617..aaadac392c47699166ffb973fa55971a2e1abfa7 100644 (file)
--- a/doc/src/sgml/release-13.sgml
+++ b/doc/src/sgml/release-13.sgml
@@ -30,6 +30,149 @@
 
     
 
+     
+      Block DECLARE CURSOR ... WITH HOLD and firing of
+      deferred triggers within index expressions and materialized view
+      queries (Noah Misch)
+     
+
+     
+      This is essentially a leak in the security restricted
+      operation sandbox mechanism.  An attacker having permission
+      to create non-temporary SQL objects could parlay this leak to
+      execute arbitrary SQL code as a superuser.
+     
+
+     
+      The PostgreSQL Project thanks
+      Etienne Stalmans for reporting this problem.
+      (CVE-2020-25695)
+     
+    
+
+    
+
+     
+      Fix usage of complex connection-string parameters
+      in pg_dump,
+      pg_restore,
+      clusterdb,
+      reindexdb,
+      and vacuumdb (Tom Lane)
+     
+
+     
+      The -d parameter
+      of pg_dump
+      and pg_restore, or
+      the --maintenance-db parameter of the other
+      programs mentioned, can be a connection string
+      containing multiple connection parameters rather than just a
+      database name.  In cases where these programs need to initiate
+      additional connections, such as parallel processing or processing of
+      multiple databases, the connection string was forgotten and just the
+      basic connection parameters (database name, host, port, and
+      username) were used for the additional connections.  This could lead
+      to connection failures if the connection string included any other
+      essential information, such as non-default SSL or GSS parameters.
+      Worse, the connection might succeed but not be encrypted as
+      intended, or be vulnerable to man-in-the-middle attacks that the
+      intended connection parameters would have prevented.
+      (CVE-2020-25694)
+     
+    
+
+    
+
+     
+      When psql's \connect
+      command re-uses connection parameters, ensure that all
+      non-overridden parameters from a previous connection string are
+      re-used (Tom Lane)
+     
+
+     
+      This avoids cases where reconnection might fail due to omission of
+      relevant parameters, such as non-default SSL or GSS options.
+      Worse, the reconnection might succeed but not be encrypted as
+      intended, or be vulnerable to man-in-the-middle attacks that the
+      intended connection parameters would have prevented.
+      This is largely the same problem as just cited
+      for pg_dump et al,
+      although psql's behavior is more complex
+      since the user may intentionally override some connection
+      parameters.
+      (CVE-2020-25694)
+     
+    
+
+    
+
+     
+      Prevent psql's \gset
+      command from modifying specially-treated variables (Noah Misch)
+     
+
+     
+      \gset without a prefix would overwrite whatever
+      variables the server told it to.  Thus, a compromised server could
+      set specially-treated variables such as PROMPT1,
+      giving the ability to execute arbitrary shell code in the user's
+      session.
+     
+
+     
+      The PostgreSQL Project thanks
+      Nick Cleaton for reporting this problem.
+      (CVE-2020-25696)
+     
+    
+
+    
+
-     
-      Fix usage of complex connection-string parameters
-      in pg_dump,
-      pg_restore,
-      clusterdb,
-      reindexdb,
-      and vacuumdb (Tom Lane)
-     
-
-     
-      The -d parameter
-      of pg_dump
-      and pg_restore, or
-      the --maintenance-db parameter of the other
-      programs mentioned, can be a connection string
-      containing multiple connection parameters rather than just a
-      database name.  In cases where these programs need to initiate
-      additional connections, such as parallel processing or processing of
-      multiple databases, the connection string was forgotten and just the
-      basic connection parameters (database name, host, port, and
-      username) were used for the additional connections.  This could lead
-      to connection failures if the connection string included any other
-      essential information, such as non-default SSL or GSS parameters.
-     
-    
-
-    
-
-     
-      When psql's \connect
-      command re-uses connection parameters, ensure that all
-      non-overridden parameters from a previous connection string are
-      re-used (Tom Lane)
-     
-
-     
-      This avoids cases where reconnection might fail due to omission of
-      relevant parameters, such as non-default SSL or GSS options.  This
-      is largely the same problem as just cited
-      for pg_dump et al,
-      although psql's behavior is more complex
-      since the user may intentionally override some connection
-      parameters.
-     
-    
-
-    
-