From ffe69b4afdae8284ad3f0d4c57640f077799cfa9 Mon Sep 17 00:00:00 2001
From: Tom Lane <tgl@sss.pgh.pa.us>
Date: Mon, 6 May 2019 12:45:59 -0400
Subject: Last-minute updates for release notes.

Security: CVE-2019-10129, CVE-2019-10130
---
 doc/src/sgml/release-9.4.sgml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/doc/src/sgml/release-9.4.sgml b/doc/src/sgml/release-9.4.sgml
index c55c194266..9bec0bf558 100644
--- a/doc/src/sgml/release-9.4.sgml
+++ b/doc/src/sgml/release-9.4.sgml
@@ -159,6 +159,23 @@
      </para>
     </listitem>
 
+    <listitem>
+     <para>
+      Check the appropriate user's permissions when enforcing rules about
+      letting a leaky operator see <structname>pg_statistic</structname>
+      data (Dean Rasheed)
+     </para>
+
+     <para>
+      When an underlying table is being accessed via a view, consider the
+      privileges of the view owner while deciding whether leaky operators
+      may be applied to the table's statistics data, rather than the
+      privileges of the user making the query.  This makes the planner's
+      rules about what data is visible match up with the executor's,
+      avoiding unnecessarily-poor plans.
+     </para>
+    </listitem>
+
     <listitem>
      <para>
       Avoid O(N^2) performance issue when rolling back a transaction that
-- 
cgit v1.2.1