AWS AmazonRDS high security documentation change
Summary
Added release notes for Babelfish versions 5.5, 4.9, 3.13, and 2.16 with new features, security enhancements, critical fixes, and stability improvements
Security assessment
The changes include multiple security-related fixes: 1) Cross-database queries now respect Dynamic Data Masking policies (security enhancement), 2) Fixed an issue where executing queries from PostgreSQL endpoint in Active Directory Authentication enabled instances may lead to a reboot (critical security fix), 3) Restricted ownership change of Babelfish objects from PG port, 4) Restricted users from altering Babelfish objects in sys schema, 5) Blocked ALTER AUTHORIZATION on database when the new owner is a database role, fixed server role, or sysadmin, 6) Blocked GRANT/REVOKE/DROP operations on Babelfish roles from PostgreSQL endpoint. These changes address potential security vulnerabilities including privilege escalation, unauthorized access, and data exposure.
Diff
diff --git a/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md b/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md index d19c1c2c0..d2a60433a 100644 --- a//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md +++ b//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraBabelfish.Updates.md @@ -35,0 +36,2 @@ For a list of supported and unsupported functionality across different Babelfish + * Babelfish for Aurora PostgreSQL 5.5 + @@ -46,0 +49,97 @@ For a list of supported and unsupported functionality across different Babelfish +### Babelfish for Aurora PostgreSQL 5.5 + +This release of Aurora Babelfish is provided with Aurora PostgreSQL 17.9. For more information about the improvements in Aurora PostgreSQL 17.9, see [Amazon Aurora PostgreSQL updates](./AuroraPostgreSQL.Updates.html). Babelfish for Aurora PostgreSQL 5.5 adds several new features, enhancements, and fixes. For more information about Babelfish for Aurora PostgreSQL, see [Working with Babelfish for Aurora PostgreSQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/babelfish.html). + +#### Aurora Babelfish release 5.5.0, April 6, 2026 + +**New Features** + + * Added support for Polygon instances for geography/geometry datatype. + + * Added support for implicit cast from (n)varchar/(n)char to datetimeoffset datatype. + + * Added support for sys.fn_varbintohexstr system object. + + + + +**Security enhancements** + + * Babelfish cross-database queries will now respect Dynamic data masking policies so that tables show masked data according to the policies defined for the current login. + + + + +**Critical enhancements** + + * Fixed an issue where executing queries from PostgreSQL endpoint in Active Directory Authentication enabled instances may lead to a reboot. + + * Fixed an issue where update with output clause may skip rows during concurrent updates. + + * DROP LOGIN now correctly returns an error when attempting to drop a login that is the owner of a database. + + + + +**High Priority stability enhancements** + + * Fixed incorrect return datatype in UNION queries involving datetimeoffset, (n)varchar and datetime types. + + * Fixed issue in coalesce involving datetimeoffset and (n)varchar types. + + * Fixed UNION and CASE expressions with varbinary and string literals to correctly resolve to varchar instead of varbinary. + + * Restricted ownership change of Babelfish objects from PG port. + + * Fixed an issue in procedure calls leading to incorrect lifecycle handling of temp tables. + + * Restricted users from altering Babelfish objects in sys schema. + + * Fixed the scale/precision handling for MIN/MAX functions on CHAR/NCHAR datatypes. + + * Fixed high CPU utilization during concurrent connection establishment for pyODBC connections. + + * Fixed inconsistent index scans for binary/varbinary comparison operators and added cross-type support. + + * Blocked ALTER AUTHORIZATION on database when the new owner is a database role, fixed server role, or sysadmin. + + * Fixed an issue in nested procedure calls that caused temp table cleanup failures and parser errors. + + + + +**Additional improvements and enhancements** + + * Fixed an issue where casting string values to sqlvariant may cause client to hang. + + * Fixed cast and convert functions between datatypes (n)char & (var)binary. + + * Added fix to handle UDT datatypes in DATEADD() function. + + * Fixed handling for white space characters in the ISNUMERIC() function to match T-SQL behavior. + + * Fixed an issue in SELECT queries with reserved keywords used as column aliases. + + * Fixed output format when casting datetime and smalldatetime to (n)varchar/(n)char. + + * Fixed handling of scale/precision for empty string casting to binary. + + * Fixed concatenation of binaries to produce expected results. + + * Fixed an issue where primary key information was not being sent in TDS response for ADO.NET FillSchema() operations. + + * Fixed scale/precision handling for concatenated results of binaries. + + * Fixed a rare issue where parallel query runs into unexpected error when table OID reaches to certain limit. + + * Fixed an issue where MONEY type conversion incorrectly rejected few valid ASCII and special characters. + + * Fixed convert function to properly apply style parameter when converting SMALLMONEY to string types, ensuring correct formatting for styles 0, 1, 2, and 126 matching with T-SQL behavior. + + * Fixed trailing blanks being incorrectly treated as insignificant in LIKE operator in case of exact pattern matching. + + * Fixed multiple convert function issues for MONEY/SMALLMONEY type to string conversions, including proper handling of negative style parameters and invalid style value. + + + + @@ -624,0 +724,2 @@ For more information about relevant permission management and access control set + * Babelfish for Aurora PostgreSQL 4.9 + @@ -645,0 +747,89 @@ For more information about relevant permission management and access control set +### Babelfish for Aurora PostgreSQL 4.9 + +This release of Aurora Babelfish is provided with Aurora PostgreSQL 16.13. For more information about the improvements in Aurora PostgreSQL 16.13, see [Amazon Aurora PostgreSQL updates](./AuroraPostgreSQL.Updates.html). Babelfish for Aurora PostgreSQL 4.9 adds several new features, enhancements, and fixes. For more information about Babelfish for Aurora PostgreSQL, see [Working with Babelfish for Aurora PostgreSQL](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/babelfish.html). + +#### Aurora Babelfish release 4.9.0, April 6, 2026 + +**New Features** + + * Added support for implicit cast from (n)varchar/(n)char to datetimeoffset datatype. + + * Added support for sys.fn_varbintohexstr system object. + + + + +**Security enhancements** + + * Babelfish cross-database queries will now respect Dynamic data masking policies so that tables show masked data according to the policies defined for the current login. + + + + +**Critical enhancements** + + * Fixed an issue where executing queries from PostgreSQL endpoint in Active Directory Authentication enabled instances may lead to a reboot. + + * Fixed an issue where update with output clause may skip rows during concurrent updates. + + * DROP LOGIN now correctly returns an error when attempting to drop a login that is the owner of a database. + + + + +**High Priority stability enhancements** + + * Fixed incorrect return datatype in UNION queries involving datetimeoffset, (n)varchar and datetime types. + + * Fixed issue in coalesce involving datetimeoffset and (n)varchar types. + + * Fixed UNION and CASE expressions with varbinary and string literals to correctly resolve to varchar instead of varbinary. + + * Restricted ownership change of Babelfish objects from PG port. + + * Fixed an issue in procedure calls leading to incorrect lifecycle handling of temp tables. + + * Restricted users from altering Babelfish objects in sys schema. + + * Fixed the scale/precision handling for MIN/MAX functions on CHAR/NCHAR datatypes. + + * Blocked ALTER AUTHORIZATION on database when the new owner is a database role, fixed server role, or sysadmin. + + * Fixed high CPU utilization during concurrent connection establishment for pyODBC connections. + + + + +**Additional improvements and enhancements** + + * Fixed an issue where casting string values to sqlvariant may cause client to hang. + + * Fixed cast and convert functions between datatypes (n)char & (var)binary. + + * Added fix to handle UDT datatypes in DATEADD() function. + + * Fixed handling for white space characters in the ISNUMERIC() function to match T-SQL behavior. + + * Fixed an issue in SELECT queries with reserved keywords used as column aliases. + + * Fixed output format when casting datetime and smalldatetime to (n)varchar/(n)char. + + * Fixed handling of scale/precision for empty string casting to binary. + + * Fixed concatenation of binaries to produce expected results. + + * Fixed scale/precision handling for concatenated results of binaries. + + * Fixed a rare issue where parallel query runs into unexpected error when table OID reaches to certain limit. + + * Fixed an issue where MONEY type conversion incorrectly rejected few valid ASCII and special characters. + + * Fixed convert function to properly apply style parameter when converting SMALLMONEY to string types, ensuring correct formatting for styles 0, 1, 2, and 126 matching with T-SQL behavior. + + * Fixed trailing blanks being incorrectly treated as insignificant in LIKE operator in case of exact pattern matching. + + * Fixed multiple convert function issues for MONEY/SMALLMONEY type to string conversions, including proper handling of negative style parameters and invalid style value. + + + + @@ -1958,0 +2149,2 @@ This release of Aurora Babelfish is provided with Aurora PostgreSQL 16.1. For mo + * Babelfish for Aurora PostgreSQL 3.13