AWS AmazonRDS high security documentation change
Summary
Added release notes for Babelfish 5.2, 4.6, and 3.10 versions with multiple enhancements. Updated version labels to mark deprecated versions and added security-related fixes including SSL handshake improvements and guest user restrictions.
Security assessment
The changes include security-related fixes: 1) Added SSL handshake segmentation to handle large server hello messages (prevents potential handshake failures/attacks). 2) Fixed guest user creating objects in guest schema (prevents unauthorized access). 3) Restricted dropping of logins via PG port (security hardening). These address concrete security vulnerabilities.
Diff
diff --git a/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md b/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md index ed0787cc1..af9386aa2 100644 --- a//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md +++ b//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md @@ -5 +5 @@ -Babelfish for Aurora PostgreSQL 5.x versionsBabelfish for Aurora PostgreSQL 4.x versionsBabelfish for Aurora PostgreSQL 3.x versionsBabelfish for Aurora PostgreSQL 2.x versionsBabelfish for Aurora PostgreSQL 1.x versions (includes some deprecated versions) +Babelfish for Aurora PostgreSQL 5.x versionsBabelfish for Aurora PostgreSQL 4.x versionsBabelfish for Aurora PostgreSQL 3.x versions (includes some deprecated versions)Babelfish for Aurora PostgreSQL 2.x versions (includes some deprecated versions)Babelfish for Aurora PostgreSQL 1.x versions (includes some deprecated versions) @@ -23 +23 @@ For a list of supported and unsupported functionality across different Babelfish - * Babelfish for Aurora PostgreSQL 3.x versions + * Babelfish for Aurora PostgreSQL 3.x versions (includes some deprecated versions) @@ -25 +25 @@ For a list of supported and unsupported functionality across different Babelfish - * Babelfish for Aurora PostgreSQL 2.x versions + * Babelfish for Aurora PostgreSQL 2.x versions (includes some deprecated versions) @@ -35,0 +36,2 @@ For a list of supported and unsupported functionality across different Babelfish + * Babelfish for Aurora PostgreSQL 5.2 + @@ -40,0 +43,122 @@ For a list of supported and unsupported functionality across different Babelfish +### Babelfish for Aurora PostgreSQL 5.2 + +This release of Aurora Babelfish is provided with Aurora PostgreSQL 17.5. For more information about the improvements in Aurora PostgreSQL 17.5, see [Amazon Aurora PostgreSQL updates](./AuroraPostgreSQL.Updates.html). Babelfish for Aurora PostgreSQL 5.2 adds several new features, enhancements, and fixes. For more information about Babelfish for Aurora PostgreSQL, see [Working with Babelfish for Aurora PostgreSQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/babelfish.html). + +#### Aurora Babelfish release 5.2.0, June 30, 2025 + +**New Features** + + * Added support for CREATE OR ALTER VIEW / ALTER VIEW syntax in Babelfish with the following limitations: + + * Can't be used on views that have INSTEAD-OF trigger attached. + + * Can't be used on views that have another view based on this view. + + * Added support of Transact-SQL UNPIVOT operators for Babelfish. + + * Added support for `STDimension`, `STDisjoint`, `STIntersects`, `STIsClosed`, `STIsEmpty`, `STIsValid` Geospatial functions. + + * Added support for collation in partition functions and partitioning columns. + + * Enabled support for scripting logins in SSMS for Babelfish. + + + + +**Critical enhancements** + + * Added “+” and “-” operator for varbinary. + + * Added new GUCs “babelfishpg_tsql.apg_enable_correlated_scalar_transform” and “babelfishpg_tsql.apg_enable_subquery_cache” to control subquery optimization features in Babelfish. The new GUCs are ON by default. + + * Added support for larger server hello messages during SSL handshake by segmenting them into 4096 byte packets. + + * Added support for CAST from VARBINARY to DATETIME in Babelfish. + + * Added support for altering user/role in Babelfish GroupAD for fixed database roles’ member. + + * Allow CREATE schema in Babelfish GroupAD via fixed db roles’ membership. + + * Fixed an issue with object ownership. Any new object created by a user from TDS endpoint will now be owned by schema owner as opposed to previous behaviour where the current user always owned the new object. + + * Added handling for default schema name for procedure in Group-AD session, when Table Valued Parameter is used as an argument of a procedure. + + + + +**High Priority stability enhancements** + + * Fixed logic to adjust precision and scale in Numeric Multiplication and Division. + + * Fixed computation of precision and scale for User defined types. + + * Fixed computation of precision and scale for constant with value 0. + + * Fixed the issue “wrong varnullingrels” error could be reported incorrectly after subquery transformation. + + * Fixed the issue that alter table will cause follow up cacade drop cmd failed to drop the database contain this table. + + * Fixed PIVOT operator to gracefully handle NULL entries in pivot column. + + * Restrict dropping of Babelfish login via PG port, if a BBF login has mapped users in all three master, tempdb and msdb databases. + + * Fixed permission denied error in Babelfish Group AD while using table variables in some scenarios. + + * Fixed bug which prevented enable/disable all triggers on tables. + + * Fixed incorrect conversion from integers to varbinary datatype. + + * Fixed Casting and Conversion from Float to Varchar datatype. + + * Fixed suser_sname() function to handle the null inputs. + + * Fixed issue with result having incorrect scale in numeric/decimal addition and subtraction. + + * Fixed issue which causes incorrect result in arithmetic operations which results in numeric/decimal type. + + * Fixed an issue which caused communication link failure with DROP LOGIN/USER/ROLE [public]. + + * Restricted dropping of system procedures and views from dbo schema. + + * Fixed an issue in round() function to ensure return types match input argument types. + + * Transfer nullability and identity properties of columns in SELECT INTO statement to new table. These properites are only transferred if there is a single table in FROM clause of SELECT INTO and the column isn't part of expression in select into statements target list. + + + + +**Additional improvements and enhancements** + + * Fixed JSON string formatting to prevent improper backslash escaping in “FOR JSON” output with json_query function. + + * Fixed an issue where guest user could create objects in guest schema. + + * Fixed PUBLIC role attributes in system views. + + * Fixed sys.objects catalog to correctly populate unique constraints metadata. + + * Fixed issue when max length of a RPC character based parameter is 0. + + * Restricted members of fixed database role db_ddladmin from creating schema for database principals that it isn't a member of. + + * Restricted members of fixed database role db_ddladmin from creating schema for database principals that it isn't a member of. + + * Added an escape hatch for the INLINE option in CREATE FUNCTION statements, defaulting to “strict” mode for proper error handling. + + * Fixed the entry in `babelfish_schema_permissions` which was getting overridden if there were table and procedure with the same name. + + * Fixed an errors while fetching the object definition of tsql objects due to handling of few nodes in `sys.tsql_get_expr`. + + * Fixed the logic for numeric/decimal datatype typmod resolution in outer/inner queries. + + * Fixed some cases of object resolution inside stored procedures, functions and trigger. + + * Fixed case expression when one of the branch is NUMERIC and other is of EXACT NUMERIC. + + * Improved index name handling in Babelfish by preserving the original index name in the catalog, making it visible in catalog views like sys.indexes. It also adds support for renaming existing indexes using sp_rename to preserve and display their original names. + + * Fixed a crash in in resolve_numeric_typmod_from_exp for aggragate functions using *(all columns). + + + + @@ -188,0 +313,2 @@ For more information about relevant permission management and access control set + * Babelfish for Aurora PostgreSQL 4.6 + @@ -203,0 +330,131 @@ For more information about relevant permission management and access control set +### Babelfish for Aurora PostgreSQL 4.6 + +This release of Aurora Babelfish is provided with Aurora PostgreSQL 16.9. For more information about the improvements in Aurora PostgreSQL 16.9, see [Amazon Aurora PostgreSQL updates](./AuroraPostgreSQL.Updates.html). Babelfish for Aurora PostgreSQL 4.6 adds several new features, enhancements, and fixes. For more information about Babelfish for Aurora PostgreSQL, see [Working with Babelfish for Aurora PostgreSQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/babelfish.html). + +###### Releases + + * Aurora Babelfish release 4.6.0, June 30, 2025 + + + + +#### Aurora Babelfish release 4.6.0, June 30, 2025 + +**New Features** + + * Added support for CREATE OR ALTER VIEW / ALTER VIEW syntax in Babelfish with the following limitations: + + * Can't be used on views that have INSTEAD-OF trigger attached. + + * Can't be used on views that have another view based on this view. + + * Added support of Transact-SQL UNPIVOT operators for Babelfish. + + * Added support for `STDimension`, `STDisjoint`, `STIntersects`, `STIsClosed`, `STIsEmpty`, `STIsValid` Geospatial functions. + + * Added support for collation in partition functions and partitioning columns. + + * Enabled support for scripting logins in SSMS for Babelfish. + + + + +**Critical enhancements** + + * Added “+” and “-” operator for varbinary. + + * Added new GUCs “babelfishpg_tsql.apg_enable_correlated_scalar_transform” and “babelfishpg_tsql.apg_enable_subquery_cache” to control subquery optimization features in Babelfish. The new GUCs are ON by default. + + * Added support for larger server hello messages during SSL handshake by segmenting them into 4096 byte packets. + + * Added support for CAST from VARBINARY to DATETIME in Babelfish. + + * Added support for altering user/role in Babelfish GroupAD for fixed database roles’ member. + + * Allow CREATE schema in Babelfish GroupAD via fixed db roles’ membership. + + * Fixed an issue with object ownership. Any new object created by a user from TDS endpoint will now be owned by schema owner as opposed to previous behaviour where the current user always owned the new object. + + * Added handling for default schema name for procedure in Group-AD session, when Table Valued Parameter is used as an argument of a procedure. + + + + +**High Priority stability enhancements** + + * Fixed logic to adjust precision and scale in Numeric Multiplication and Division. +