It has come to our attention that the PostGIS Raster support may give more privileges to users than an administrator is willing to grant. These include reading files from the filesystem and opening connections to network hosts.
Both issues can be limited in existing installations by setting the GDAL_SKIP variable (in the PostgreSQL server environment) to the list of all gdal drivers, but some drivers would still be forceably loaded by some operations.
Releases 2.1.3 and 2.0.6 strengthen the code to load no drivers by default and allows for a fine-grained tuning of what’s allowed and what not through postgis-specific environment variables:
Specifies a list of GDAL drivers to enable (rather than skip) By default all drivers are disabled. Example value: “GTiff PNG JPEG”
Enables read support for out-db raster bands if set to 1. By default out-db raster bands reading is disabled.
Upgrade is highly recommended, especially for online services allowing users to run arbitrary SQL queries.
Special thanks to Even Rouault for bringing up the issue and giving advice on its resolution.
The PostGIS Team is pleased to release PostGIS 3.2.0, the Olivier Courtin release.
This release would not be possible without the various developers listed in the credits as well as the companies that provided funding and developer time.
Companies that contributed significantly to this release are:
In March 2020 we lost a long time PostGIS developer and friend, Olivier Courtin. The PostGIS 3.2.0 release is named in his honor.
The PostGIS Team is pleased to release the first rc of the upcoming PostGIS 3.2.0 release.
Best served with PostgreSQL 14. This version of PostGIS can utilize the faster GiST building support API introduced in PostgreSQL 14. If compiled with recently released GEOS 3.10.1 you can take advantage of improvements in ST_MakeValid and numerous speed improvements. This release also includes many additional functions and improvements for
postgis_topology extensions and a new input/export format FlatGeobuf.