PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

"This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update immediately."

So if I have no databases that start with "-", I'm not vulnerable? Didn't quite understand what they meant by that.

Just from the quote cited by octo_t I would read that you are still vulnerable: A malicious database user could craft a _connection string_ which contains a database name starting with -. There's no hint that the database has to exist on your server for this to work, so I would read it could be a complete bogus request and still damage your files.

I'm not an expert so I'll ask here:

Is there an attack vector if you run PostgreSQL locally, no untrusted users are able to create connection strings and do not allow remote access?

It seems to be no but I prefer to be sure ;)

Nope. Looking at the release notes:

> Fix insecure parsing of server command-line switches (Mitsumasa Kondo, Kyotaro Horiguchi)

So I assume command-line switch parsing is somehow involved in parsing the connection string (probably because the same connection strings can be used from API and from CLI?), I guess a database name with a leading `-` can be interpreted as a switch and execute corrupting commands.

edit: according to the dedicated FAQ:

> The vulnerability allows users to use a command-line switch for a PostgreSQL connection intended for single-user recovery mode while PostgreSQL is running in normal, multiuser mode. This can be used to harm the server.