来自 PostgreSQL 官方消息：

PostgreSQL 全球开发组刚刚在 5月9日 发布目前多个 PostgreSQL 版本更新，包括： 11.3, 10.8, 9.6.13, 9.5.17, 和 9.4.22。这次的版本更新主要修复两个 PostgreSQL 服务器的安全问题，其中一个是关于 PG 的 Windows 安装程序问题，同时包括最近三个月修复的 60 多个 Bug。

强烈建议使用 Windows 安装程序安装 PG 的用户尽快升级，此外任何 PostgreSQL 9.5, 9.6, 10, 和 11 也建议尽快升级。

这两个安全漏洞是：

  • CVE-2019-10127: BigSQL Windows installer does not clear permissive ACL entries
  • CVE-2019-10128: EnterpriseDB Windows installer does not clear permissive ACL entries

其他的 Bug 修复和改进包括：

  • Several catalog corruption fixes, including one related to running ALTER TABLE on a partitioned table
  • Several fixes for partitioning
  • Avoid server crash when an error occurs while trying to persist a cursor query across a transaction commit
  • Avoid O(N^2) performance issue when rolling back a transaction that created many tables
  • Fix possible “could not access status of transaction” failures in txid_status()
  • Fix updatable views to handle explicit DEFAULT items in INSERT .. VALUES statements where there are multiple VALUES rows
  • Fix CREATE VIEW to allow zero-column views
  • Add missing support for the CREATE TABLE IF NOT EXISTS .. AS EXECUTE .. statement
  • Ensure that sub-SELECTs appearing in row-level-security policy expressions are executed with the correct user's permissions
  • Accept XML documents as valid values of type xml when xmloption is set to content, as required by SQL:2006 and later
  • Fix incompatibility of GIN-index WAL records that were introduced in 11.2, 10.7, 9.6.12, 9.5.16, and 9.4.21 that affected replica servers running these versions reading in changes to GIN indexes from primary servers of older versions
  • Several memory leak fixes as well as fixes to management of dynamic shared memory
  • Relax panics on fsync and sync_file_range failures for certain cases where a failure indicated "operation not supported"
  • Several fixes to the query planner, several of which should lead to planning improvements
  • Fix race condition in which a hot-standby postmaster could fail to shut down after receiving a smart-shutdown request
  • Several fixes for SCRAM authentication
  • Fix handling of lc_time settings that imply an encoding different from the database's encoding
  • Create the current_logfiles file with the same permissions as other files in the server's data directory
  • Several ecpg fixes
  • Make pg_verify_checksums verify that the data directory it's pointed at is of the right PostgreSQL version
  • Several fixes for contrib/postgres_fdw, including one for remote partitions where an UPDATE could lead to incorrect results or a crash
  • Several Windows fixes