It has come to our attention that the PostGIS Raster support may give more privileges to users than an administrator is willing to grant. These include reading files from the filesystem and opening connections to network hosts.
Both issues can be limited in existing installations by setting the GDAL_SKIP variable (in the PostgreSQL server environment) to the list of all gdal drivers, but some drivers would still be forceably loaded by some operations.
Releases 2.1.3 and 2.0.6 strengthen the code to load no drivers by default and allows for a fine-grained tuning of what’s allowed and what not through postgis-specific environment variables:
Specifies a list of GDAL drivers to enable (rather than skip) By default all drivers are disabled. Example value: “GTiff PNG JPEG”
Enables read support for out-db raster bands if set to 1. By default out-db raster bands reading is disabled.
Upgrade is highly recommended, especially for online services allowing users to run arbitrary SQL queries.
Special thanks to Even Rouault for bringing up the issue and giving advice on its resolution.
The PostGIS Team is pleased to release the first alpha of the upcoming PostGIS 3.2.0 release.
Best served with PostgreSQL 14 beta3. This version of PostGIS utilizes the faster GiST building support API introduced in PostgreSQL 14. If compiled with the in-development GEOS 3.10dev you can take advantage of improvements in ST_MakeValid. This release also includes many additional functions and improvements for
The PostGIS development team is pleased to provide bug fix and performance enhancements 3.1.4 and 3.0.4 for the 3.1, 3.0 stable branches.
3.1.4 This release supports PostgreSQL 9.6-14.
3.0.4 This release works with PostgreSQL 9.5-13 and GEOS >= 3.6 Designed to take advantage of features in PostgreSQL 12+ and Proj 6+
View all closed tickets for 3.1.4, 3.0.4.
After installing the binaries or after running pg_upgrade:
For PostGIS 3.1, 3.0, 2.5 do below which will upgrade all your postgis extensions.
For PostGIS 2.4 and below do:
ALTER EXTENSION postgis UPDATE;
— if you use the other extensions packaged with postgis — make sure to upgrade those as well
ALTER EXTENSION postgis_sfcgal UPDATE; ALTER EXTENSION postgis_topology UPDATE; ALTER EXTENSION postgis_tiger_geocoder UPDATE;
If you use legacy.sql or legacy_minimal.sql, make sure to rerun the version packaged with these releases.
The PostGIS Team is pleased to release PostGIS 3.1.3! Best Served with PostgreSQL 14 beta2.
This release is a bug fix release, addressing issues found in the previous 3.1 release.
#4929, Fix missing error from GetRingEdges when invoked with unexistent topology or edge (Sandro Santilli)
#4927, Fix PostgreSQL 14 compile FuncnameGetCandidates changes needed to compile against PostgreSQL 14 beta2 or higher (Regina Obe, Julien Rouhaud)