The PostgreSQL ODBC driver version REL-18_00_0002 is now available, bringing important security patches and stability improvements. This release updates the bundled OpenSSL to 3.5.5 and fixes multiple issues reported by the community, particularly in connection-string parsing, cursor handling, and buffer management. Developers using ODBC-based applications should update promptly to mitigate potential security risks.
Key changes in this release:
- Upgraded bundled OpenSSL to 3.5.5 for security compliance (PR #169).
- Fixed
SQLPrimaryKeysto exclude INCLUDE columns from results, aligning with SQL standard behavior (PR #171). - Resolved a stack buffer overflow in
getPrecisionPart()that could cause crashes or remote code execution (CVE-related, PR #174). - Prevented reading past the end of
conn_settingsarray, mitigating out-of-bounds memory access (PR #176). - Added validation of percent-encoded characters in connection strings to block malformed or malicious inputs (PR #175).
- Handled ARD bookmark allocation failure gracefully to avoid undefined behavior (PR #179).
- Fixed incorrect version reporting in the driver (PR #181).
- Rejected overlong cursor names to prevent buffer overflows (PR #178).
- Rejected invalid
SQLPutDatalengths to prevent potential memory corruption (PR #182). - Detached freed app descriptors from statements to avoid use-after-free (PR #183).
For developers, these fixes are critical for securing ODBC-based connectivity in production environments. The stack overflow and connection-string validation issues could be exploited by attackers to crash applications or execute arbitrary code. Regular users of SQLPrimaryKeys will now get correct results without INCLUDE columns. Upgrade via the official download page.
Source: https://www.postgresql.org/about/news/postgresql-odbc-version-rel-18_00_0002-released-3341/