PostgreSQL Summer of Code 2008

PostgreSQL has been invited by Google to be part of Google's Summer of Code
2008. They are calling all students, professors and potential mentors to
participate.

For Summer of Code, Google will be paying for student internships to work
on PostgreSQL features and applications. They've put up a list of ideas,
including guidelines for submissions and more. Applications for students
open March 25th, and close March 31, so urge any students you know to get
your applications prepared right away!

-- Ideas and Guidelines:
http://www.postgresql.org/developer/summerofcode

-- Summer of Code FAQ:
http://code.google.com/opensource/gsoc/2008/faqs.html

Guido van Rossum posted the slides of his PyCon 2008 keynote on python.org

Guido van Rossum posted the slides of his PyCon 2008 keynote on python.org

There's both a PowerPoint and a PDF file.

PS. The Python 3.0 final release is now scheduled for September 3, 2008. See PEP 361.

PostgreSQL 8.3 has been released

Today the PostgreSQL Global Development Group releases the long-awaited
version 8.3 of the most advanced open source database, which cements our
place as the best performing open source database. Among the
performance features you'll be excited about in 8.3 are:

-- Heap Only Tuples
-- BGWriter Autotuning
-- Asynchronous Commit
-- Spread Checkpoints
-- Synchronous Scan
-- "Var-Varlena"
-- L2 Cache Protection
-- Lazy XID

8.3 also has a lot of cool features for PostgreSQL DBAs and developers,
including:

-- SQL/XML
-- CSV Logging
-- MS Visual C++ support
-- ENUMs
-- Integrated Tsearch
-- SSPI & GSSAPI
-- Composite Type Arrays
-- pg_standby

There are many, many other features included in this release. Visit thefeatures list (http://www.postgresql.org/about/press/features83.html)and the features matrix (http://www.postgresql.org/about/featurematrix)for more information, and browse the release notes(http://www.postgresql.org/docs/8.3/static/release-8-3.html) to see themore than 300 patches that went into the release. You can even visit the press page (http://www.postgresql.org/about/press/presskit83.html).
Or just go ahead and download and install 8.3:
-- Source: http://www.postgresql.org/ftp/source/v8.3.0-- Windows Binaries: http://www.postgresql.org/ftp/binary/v8.3.0/win32-- Fedora, Red Hat, Solaris Binaries:http://www.postgresql.org/ftp/binary/v8.3.0

PostgreSQL Global Development Group released updated versions which patch five security vulnerabilities

Today the PostgreSQL Global Development Group is releasing updated
versions which patch five security vulnerabilities. These releases
update all current PostgreSQL versions, including 8.2, 8.1, 8.0, 7.4 and
7.3. They are considered CRITICAL and PostgreSQL DBAs and sysadmins
should install the update as soon as they reasonably can. Our security
team has made all efforts to make these patches backwards-compatible,
and upgrading does not require converting your data files.

Please read the remainder of this message for further important details
and announcements.

Details of Security Fixes
----------------------------
There are five security fixes included in this release. None of these
issues are known to have been exploited in the field; they were
discovered through security analysis.

Index Functions Privilege Escalation (CVE-2007-6600): as a unique
feature, PostgreSQL allows users to create indexes on the results of
user-defined functions, known as "expression indexes". This provided
two vulnerabilities to privilege escalation: (1) index functions were
executed as the superuser and not the table owner during VACUUM and
ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION were
permitted within index functions. Both of these holes have now been
closed.

Regular Expression Denial-of-Service (CVE-2007-4772, CVE-2007-6067,
CVE-2007-4769): three separate issues in the regular expression
libraries used by PostgreSQL allowed malicious users to initiate a
denial-of-service by passing certain regular expressions in SQL queries.
First, users could create infinite loops using some specific regular
expressions. Second, certain complex regular expressions could consume
excessive amounts of memory. Third, out-of-range backref numbers could
be used to crash the backend. All of these issues have been patched.

DBLink Privilege Escalation (CVE-2007-6601): DBLink functions combined
with local trust or ident authentication could be used by a malicious
user to gain superuser privileges. This issue has been fixed, and does
not affect users who have not installed DBLink (an optional module), or
who are using password authentication for local access. This same
problem was addressed in the previous release cycle (see CVE-2007-3278),
but that patch failed to close all forms of the loophole.

EOL Notices
---------------------
Minor release 7.3.21 for PostgreSQL version 7.3 will be the last update
to the 7.3 branch. As version 7.3 is now over five years old, the
community will no longer release patches for it after today's release.
Users of version 7.3 are encouraged to upgrade to a more current version
as soon as possible, or to seek support from a commercial support vendor
who is willing to continue backpatching for them.

8.1.11 and 8.0.15 are also the last 8.1 and 8.0 update releases for
which the PostgreSQL community will produce binary packages for Windows.
Windows users are encouraged to move to 8.2.6 or later, since there are
Windows-specific fixes in 8.2 that are impractical to back-port. 8.1
and 8.0 updates will continue to be supported on other platforms and in
source form.

Download and Install
------------------------
PostgreSQL minor releases 8.2.6, 8.1.11, 8.0.15, 7.4.19 and 7.3.21 are
available through our FTP mirror network:

-- Source Code: http://www.postgresql.org/ftp/source/
-- Binaries for some platforms: http://www.postgresql.org/ftp/binary/

If you need additional information on the included updates, it's
available in the Release Notes
(http://www.postgresql.org/docs/current/static/release.html). These
upgrades can be copied directly over existing PostgreSQL binaries and do
not require dump-and-reload for any system which has been updated in the
last six months (older versions may require some specific post-update
steps; see the release notes).

As always, PostgreSQL update releases are cumulative. All security
fixes will be included in the upcoming version 8.3 release candidate.
This notice will be posted to the PostgreSQL security page:
http://www.postgresql.org/support/security

pgAdmin III v1.8.1 released

pgAdmin 1.8.1, the Open Source graphical PostgreSQL administration tool
for Windows, Linux, FreeBSD, Mac OS X and Solaris, now available for
download in source and a variety of binary formats from:

http://www.pgadmin.org/download/

v1.8.1 is primarily a bug fix release, including the following changes:

- Fix a bug that could cause a crash on GTK when closing the query tool
in certain circumstances.
- Avoid a crash if the connection is lost and the Functions node is
refreshed.
- Avoid crashes when working with objects with % characters in the
name.
- Properly reverse-engineer the SQL for indexes with DESC, NULLS FIRST
or NULLS LAST column options.
- Only offer the Jobs node if the user can access the pgagent schema.
- Ensure the 'Create Rule' context menu option is always offered when
appropriate.
- Prevent the user from trying to debug catalog objects.
- Refresh the tree without erroring after creating a new package on
EnterpriseDB.
- Fix a crash that occured if an object called '%' was selected in the
treeview, per Alexander Steffens.
- Fix a line number error in the debugger seen with procedures which
start on the same line as the 'CREATE PROCEDURE foo IS ...' Per report
from Heikki Linnakangas.
- Cleanup the covering index control logic in the Foreign Key dialogue.
- Fix to refresh version string and number, and last OID, per a report
from Alexander Kirpa.
- Disable CREATE FUNCTION etc. under EnterpriseDB packages because they
are created as part of the main package body.
- Fix some broken references to online help pages.
- Don't offer 'Drop Cascaded' unless the user can 'Drop' the object.
- Prevent non-superusers from attempting to use the debugger because the
plugin API won't let them anyway.
- Check that functions exist before debugging or setting global
breakpoints on them. Remove them from the treeview if not.
- Correct the URL for the EDB public synonym help page
- Handle the corner case when a user includes quotes in an object name
(backport of 2007-10-26 fix applied to trunk)
- Fix the debugger's connection class to ensure database names requiring
quotes will work and that is can be used with SSL and Kerberos
connections.
- Allow the length of array-typed columns to be changed (eg. 'character
varying[](100)'), per report from Ferenc Lutischan
- Don't allow the user to direct-debug trigger functions, only global
breakpoints should be used on them (or the trigger itself).
- Don't offer edbspl functions when creating triggers as they should
have inline bodies.
- Don't quote database names that happen to be keywords when starting
the debugger.
- Don't offer package names and system schemas as schemas when creating
public synonyms.
- Fix pgAgent's job query when a host agent is specified so that jobs
don't execute every time round the loop regardless of schedule, per
Brian Kalbfus.
- Add EnterpriseDB's default database (edb) to the Server dialog's
default option.
- Don't allow the user to debug an EnterpriseDB package function or
procedure if the body isn't defined.
- Don't offer the user the chance to create new columns on system
catalogues.
- Fix the debugger to send actual NULL values rather than 'NULL' through
the EnterpriseDB callable statement API. Allow parameter values to be
NULL or empty strings on both PostgreSQL and EnterpriseDB using the
same syntax as the Edit Grid.
- Always open the PostgreSQL Help when selecting that menu option, even
if connected to EnterpriseDB.
- Fix EnterpriseDB public synonym loading so that they aren't considered
system objects.
- Fix path discovery on Unix so standard installs can be relocated
easily.
- Fix character number display in the query tool.
- Use popen() when testing the versions of helper apps on non-windows
platforms to avoid an obscure bug on PPC Macs that could leave
wxExecute hanging indefinitely whilst waiting on a zombie process.
- When creating a new index and specifying both tablespace and fill
factor, make sure the SQL is formulated correctly, per Stefan Wolf
- Fix the locks tab on the server status dialogue so it works correctly
with PostgreSQL 8.3+.
- Properly format the object comments shown in the properties list when
a collection node is selected. Per report from Mike Blackwell.
- Fix a bug preventing the 'on error' flag of a pgAgent job step being
edited, per Jon Roberts.
- Properly escape _'s in queries for schemas, per Derek Fonda.
- Don't try to enable/disable prepared transaction related controls on
pre-8.1 servers, per Karl Zellnig

Django Running on Jython

It is true, Django is running on Jython. Check out all the details here: http://zyasoft.com/pythoneering/2008/01/django-on-jython-minding-gap.html

Inaugural Issue Of Postgres Online Magazine Available

The inaugural issue of the Postgres Online Magazine is available. The magazine is available in two formats: HTML and PDF

Here is the table of contents

From the Editors
PostgreSQL The Road Behind and Ahead

What's new and upcoming in PostgreSQL
PostgreSQL 8.3 is just around the Corner

PostgreSQL Q & A
Converting from Unix Timestamp to PostgreSQL Timestamp or Date Beginner
Using Distinct ON to return newest order for each customer Intermediate
How to create an index based on a function Intermediate

Basics
The Anatomy of a PostgreSQL - Part 1 Beginner
How does CLUSTER ON improve index performance Intermediate

PL Programming
Language Architecture in PostgreSQL Intermediate

Using PostgreSQL Contribs
PostGIS for geospatial analysis and mapping Intermediate

Application Development
Database Abstraction with Updateable Views Advanced

Product Showcase
Serendipity Blogging Software

A Product of Paragon Corporation

You can read the magazine here: http://www.postgresonline.com/

xTuple Apps 2.3: PostgreSQL-powered Open Source ERP adds Yahoo!, Returns, Job Shop

xTuple, the leader in open source enterprise resource planning software, announced the general availability of version 2.3 of the xTuple Applications, PostBooks and OpenMFG. Featuring more than 200 community-driven enhancements in just three months, version 2.3 adds:

* support for customer returns and service management;

* an expansion of unit of measure options in sales, purchasing, and inventory;

* better support for job shops and engineer-to-order companies;

* the ability to reserve specific product inventory for particular sales orders;

* and a rich XML-powered interface for external ordering systems, including prebuilt order mapping for web stores powered by Yahoo! Merchant Solutions.

The xTuple Applications are advanced ERP software solutions built with open source components, such as the PostgreSQL database, the Qt toolkit for C++, and the OpenRPT report writer. The fully integrated packages include Inventory Management, Product Definition and Costing, Work Order Management, Manufacturing, Purchasing, Sales, Shipping and Receiving, Project Management, Sales Analysis, Accounts Payable, Accounts Receivable, a full General Ledger, and Corporate/Customer Relationship Management. Both packages are fully multi-currency, multi-lingual, and support a range of multi-layered taxation structures. The commercial OpenMFG product adds Manufacturing Scheduling, Capacity Planning, and several other advanced features.

"The progress in the product from release to release is amazing," said Ritzo Muntinga, president of Oceanside, California-based ElectroSport Industries. ElectroSport manufactures specialized power accessories for the streetbike, dirtbike and ATV aftermarket, and championed the Sales Order Reservations functionality new in version 2.3. "We're very impressed with the functionality and stability of OpenMFG, and the xTuple team's ability to design new features without making the application overly cluttered or difficult to use."

The xTuple online community is growing by leaps and bounds as well; there have been over 40,000 downloads of the PostBooks software, and the project has catapulted into the Top 10 projects on the SourceForge open source repository (out of 165,000). In addition to product enhancements, the open source community has contributed translations of the applications into French, Spanish, Chinese, Russian, and Turkish - with efforts underway in German, Japanese, and several other languages.

PostBooks is available free of charge under the OSI-approved Common Public Attribution License (CPAL). OpenMFG is available under xTuple's innovative hybrid license, whereby customers and partners have full access to the application source code, and any enhancements made to the product flow back to xTuple for review, quality testing, and possible incorporation into the baseline product. Both PostBooks and OpenMFG run equally well on Mac, Windows, and Linux computers, and are fully internationalized with multi-currency, support for multiple tax structures, and multilingual translation packs maintained by the global open-source community. All this and more, including public discussion forums, blogs, and the community issue/bug tracker, can be found at www.xtuple.org.

About xTuple:
xTuple (formerly OpenMFG) develops next-generation, enterprise-class business process applications powered by open source software such as Linux, PostgreSQL, and Qt. xTuple products, led by its OpenMFG, OpenRPT and new PostBooks applications, give companies better control over operations, increased productivity, and measurable growth across all areas of their businesses-all at a lower cost of ownership. For more information, please visit the company Web site at www.xtuple.com.

Viewalyzer 1.0.2 Released

Viewalyzer is a graphical tool for recompiling Views and all dependent views. Also all Grants on all views will be available after recompiling. Before recompilation a backup will be made. When some unsolvable errors occur during recompilation everything will be “rolled back”. Also an errorlog is written to get informations what has happened. All your originally written DDL’s can be stored in the database and will that way be used during recompilation. You now can use “CREATE VIEW my_view AS SELECT * FROM my_table” and this will be used every time you recompile this view or one that my_view is dependent on.

New Features:

- Documentation available
- Compatibility with postgres 8.0 – 8.2
- Some minor bugs fixed


Download here: http://sourceforge.net/projects/viewalyzer/
Screen shots here: http://www.consipio.de/index.php?option=com_content&task=view&id=36&Itemid=48

You need Java 1.6 to run Viewalyzer

IronPython 2.0 Alpha 7 is now available:

IronPython 2.0 Alpha 7 (source and binary) is now available:
IronPython Project Homepage
Release Notes and Download

There’s been numerous changes to IronPython in the past month and a half. Most notably a lot of work has been done to get usage of the ‘yield’ statement compatible with CPython 2.5. There might be a few more changes that need to be made, but by and far IP now adheres to PEP 342. Another notable change brings the code closer to the new hosting API spec they published on the mailing list. The next couple of releases should finish that work.

Zenoss Core 2.1.2 Available

The latest packaged version of Zenoss Core, version 2.1.2 is available for download.

Zenoss Core 2.1.2 is available from: http://www.zenoss.com/download

This is primarily a maintenance release that addresses the following issues:
ZENMODEL

* Fixed MinMaxThreshold escalation always escalating to 5 (2394)
* Fixed Production state error for non-existent devices in the stopProductionStates list. (2404)
* Fixed MinMaxThreshold string values failure (2419)
* Changing device settings from System/Group fails to update deviceSearch catalog (2433)
* Allow for branch DeviceClasses and EventClasses to be added to ZenPacks (2332)
* Fixed T1 interface display speed (2444)

ZENEVENTS

* Made sure "clear" emails/pages are resent if there is a failure sending (2448)
* Device priority not being set on events (2483)

USER INTERFACE

* Made sure that ZenUsers do not lose ZenUser role when changing their password (2350)
* Fixed UnicodeDecodeError (2127)
* Repeat display for alering rules flip-flops "Does not repeat" display (2409)
* Corrected zoom controls malfunction in IE7 (2425)
* Corrected missing Navtool on OS/Filesystems with more than 40 entries. (2174)

DATACOLLECTOR

* Fixed checkCiscoChange method in SnmpClient (2004)
* Do not monitor hard disks with empty IDs (2398)

ZENRRD

* Fixed issue where disabled RRD Thresholds continued to send events (2278)
* Zencommand thresholds now getting proper eventclass (2423)

GRAPHING

* Apply TALES from DataPointGraphPoint to associated ThresholdGraphPoint. (2382)
* Allow TALES to be used within GraphPoint RPNs (2383)

ZENREPORTS

* Corrected typo in memory performance report (2487)

ZENPACKS

* Fixed broken DellDeviceMap condition (2454)
* Fixed broken HPDeviceMap condition (2455)
* HttpMonitor now usesthe user-supplied timeout value in data sources (2482)
* Removed HelloWorldZenPack from the RPM spec file (2342)

ZENOSSINST

* Fixed pyip version of zenping (1881)

Volume 2, Issue 4 of The Python Papers Available For Download

The latest PDF may be downloaded from http://archive.pythonpapers.org/ThePythonPapersVolume2Issue4.pdf. It is their largest issue yet at 81 pages and is chock full of great content.

Table of Contents for Volume 2, Issue 4

Letter from the editor: Page 4
Industry Articles
GrrlCamp: Page 6
News from the Python Software Foundation: Page 9
Interview with Michael Foord: Page 16
Screen Scraping Web Pages: Page 22
Interview with Resolver Systems: Page 24
Eight Tips for Starting with Python: Page 30
Python Events: Page 80
Peer Reviewed Section
Acknowledgment of Reviewers: Page 34
pypk - A Python extension module to handle chemical kinetics in plasma physics modeling: Page 35
The Why and How for Design Patterns: Page 48
Python Switch Statement: Page 58
An Introduction to Test Driven Generation: Page 64

PostgreSQL Maestro 7.12 released (8.3 support and more)

SQL Maestro Group announces the release of PostgreSQL Maestro 7.12, a
powerful Windows GUI solution for PostgreSQL administration and database
development.

http://www.sqlmaestro.com/products/postgresql/maestro/

New features
=================

PostgreSQL 8.3 management extensions:

1. Support for ENUM types has been added. You can create new such types,
edit existing ones and, of course, drop unnecessary types. Also the
corresponding editor has been implemented in the Data Grid (also works for
domains based on ENUM types, domains based on domains based on ENUM types
and so on).

2. Function management: now it is possible to set up the environment for a
function as well as customize its execution cost and estimated number of
rows returned by a set-returning function.

3. Support for XML and UUID types has been implemented.

Other server management extensions:

1. The Rule permission is no longer displayed for PostgreSQL 8.2+ because it
was removed in that release for security reasons.

2. SQL parser now accepts queries with !~~, ~~, ~~* and !~~* operators (SQL
Formatter, View Editor).

Interface improvements:

1. The SQL Generator tool has been implemented. Use this feature to produce
various SQL scripts (CREATE, DROP, SELECT, INSERT, etc) for the selected
object. The result script can be saved to a file, copied to clipboard, and
opened in SQL Editor or SQL Script Editor.

2. Data Grid: the notification pane is now displayed after simple mode
activation (filtering, grouping and sorting features are not supported in
this mode). All the related settings can be customized in the Options
dialog.

3. Data Grid: the Generate Query command has been added to the Table / View
Editor. Use this command to copy current filter conditions to the SQL Editor
window as an SQL query. It is also possible to copy filter condition to
clipboard as WHERE clause using grid's popup menu.

4. Data Grid: now it is possible to encrypt the contents of the selected
cell by the md5 algorithm (the corresponding item has been added to grid's
popup menu).

5. Object editors, SQL Editor, Database Designer, BLOB Viewer and other
database-dependent windows: only connected databases are now displayed in
the drop-down list.

6. Some other minor improvements and corrections.

Full press release:
http://www.sqlmaestro.com/news/company/4706/

Background information:

SQL Maestro Group is engaged in developing complete database admin and
management tools for MySQL, Oracle, MS SQL Server, PostgreSQL, SQLite,
Firebird and MaxDB providing the highest performance, scalability and
reliability to meet the requirements of today's database applications.

IronPython Studio Is Now Available From CodePlex

IronPython Studio is a free full IDE (Integrated Development Environment) for the Python programming language. It is based on the existing IronPython example that is included in the VS SDK.IronPython Studio is based on the Visual Studio 2008 Shell runtime (royalty free) and can be installed without requiring any version of Visual Studio.

Get it here: http://www.codeplex.com/IronPythonStudio

Resolver Systems announces the public Beta release of Resolver One: the first Spreadsheet/Python hybrid

Resolver Systems (www.resolversystems.com) today announces the public Beta release of its groundbreaking program, Resolver One, a Rapid Application Development tool for analysing and presenting business data using a familiar spreadsheet interface. Resolver One integrates databases, code and IT-developed components to create powerful and easy-to-use solutions - all using your existing knowledge of spreadsheets. The power and ingenious flexibility of Resolver One comes from the fact that it is fully programmable with Python code. After the success of the private Beta subscription in September 2007 (more than 1,000 sign-ups), Resolver is now planning on an official v1.0 release as early as January 2008.

Today Resolver Systems announces the public beta of Resolver One, a revolutionary improvement in spreadsheet systems. In Resolver One, the spreadsheet is a computer program
“This will change the way businesses think about and use spreadsheets. So many of the problems of the traditional model – poor database integration, and the lack of auditing, iterative analysis, or web-publishing - are solved when you realize that any spreadsheet is, at heart, just a computer program,” said Giles Thomas, CTO and MD of Resolver Systems.

“With this launch,” said Jean Viry-Babel, Head of Sales, “we get the opportunity to get our product into the hands of the 1,000s of people who have expressed an interest since Resolver One was featured on Jon Udell’s blog and Slashdot.”

Resolver One uses the Python programming language which was first released in 1991. Python is an easily learnable and highly expressive language with a rich standard library; it has been successfully used in a wide variety of applications, in businesses and in academia. Its clean syntax allows newcomers to become productive rapidly, while its more sophisticated features and built-in test framework allow experienced developers to build powerful tools which can adapt quickly to changing requirements.

“We’re excited that at last people will be able to develop sophisticated applications, all within a familiar spreadsheet interface,” added Giles Thomas.

About Resolver Systems:

Resolver Systems was founded in 2005 to produce a next generation spreadsheet. The founders, Giles Thomas, Robert Smithson and Patrick Kemmis, had all struggled with the challenges of running multi-million or multi-billion dollar businesses through poorly debugged spreadsheets. Their solution – Resolver One – seamlessly integrates a powerful and flexible programming language and a traditional spreadsheet environment. Already Resolver One has received extensive interest from companies in the financial, medical and academic communities.

Python 3.0 Alpha 2 Has Been Released!

Python 3.0 Alpha 2 Has Been Released!

Get it here: http://python.org/download/releases/3.0/

Whitebeam 1.1.5 released

Whitebeam is an open source web-application server built on PostgreSQL for data storage and the Mozilla SpiderMonkey JavaScript engine for application logic.

Started in 2000 and released as open source in 2001, Whitebeam is a mature product that has been in commercial operation hosting real web applications for over 6 years. Examples of commercial applications :
http://www.whitebeam.org/community/users.rhtm

The latest release (1.1.5) follows several years of continuous development in both performance and functionality. JavaScript bindings are provided to the PostgreSQL database, LibGD for image manipulation, SMTP for email creation, HTTP for SOAP and XML/RPC like applications amongst others.

For those that don't want to write SQL, Whitebeam 'Templates' provide high-level functional abstractions. In addition the templates avoid any possibility of 'SQL injection' security issues common with other web development platforms. Examples of 'templated' functionality include hierarchical tree-like catalogues, session management, contact/membership management and data collections.

Full documentation is available on the Whitebeam web-site
http://www.whitebeam.org

Or from the SourceForge project page :
http://sourceforge.net/projects/whitebeam

Whitebeam runs as an Apache web-server module, either on Apache 1.3, 2.0 or 2.2.

Security fix for vulnerability in Django's internationalization framework.

A fix has been released for a security vulnerability discovered in Django's internationalization framework. The complete details are below, but the executive summary is that you should updated to a fixed version of Django immediately.

You can download them at http://www.djangoproject.com/download/. Those tracking trunk development should "svn update" as soon as possible.

Description of vulnerability
A per-process cache used by Django's internationalization ("i18n") system to store the results of translation lookups for particular values of the HTTP Accept-Language header used the full value of that header as a key. An attacker could take advantage of this by sending repeated requests with extremely large strings in the Accept-Language header, potentially causing a denial of service by filling available memory.

Due to limitations imposed by web server software on the size of HTTP header fields, combined with reasonable limits on the number of requests which may be handled by a single server process over its lifetime, this vulnerability may be difficult to exploit. Additionally, it is only present when the "USE_I18N" setting in Django is "True". Nonetheless, all users of affected versions of Django will be encouraged to update.

Affected versions
Django trunk prior to revision [6608].
Django 0.96
Django 0.95 (including 0.95.1)
Django 0.91
Resolution
New versions of Django containing this fix have been released today which lter this caching mechanism to store shortened, normalized values and to reject improperly-formatted headers.

These versions are called:

Django 0.96.1 (replaces Django 0.96)
Django 0.95.2 (replaces Django 0.95.1)
Django 0.91.1 (replaces Django 0.91.1)
Anyone using a stable Django release should upgrade to one of these point releases immediately. These fixed versions have already been provided to maintainers of Django packages for various OS distributions and should be released shortly.

Anyone tracking Django's trunk development should use Subversion to update to at least revision [6608].

PostgreSQL 8.3 Beta 1 now ready for testing!

The PostgreSQL Global Development Group released the long-awaited
first beta of version 8.3. Thanks to an unprecedented number of new
patches, this version introduces more new and improved features than any
previous one. Of course, more new features means that 8.3 needs more
user testing than any previous version, so we're counting on you to
download it and test it with development versions of your applications.

Among the features in the new version are:

-- Greatly improved performance consistency, through HOT, Load Distributed Checkpoint,
JIT bgwriter, Asynchronous Commit, and other features.
-- TSearch2 full text search integrated into the core code with improved syntax and ease of adding custom dictionaries.
-- SQL:XML syntax.
-- Logging to database-loadable CSV files.
-- Automated rebuilding of cached plans.
-- ENUMs, UUIDs and arrays of complex types.
-- GSSAPI and SSPI authentication support.


See the 8.3 Beta Page (http://www.postgresql.org/developer/beta) formore information on downloads, testing, documentation, and reportingbugs. Get started downloading the beta at:Source code: http://www.postgresql.org/ftp/source/v8.3beta1/Win32 Binaries: http://www.postgresql.org/ftp/binary/v8.3beta1/win32/

openSUSE 10.3 is Now Available

Novell today announced the availability of openSUSE® 10.3, the newest version of the award-winning community Linux* distribution. Available for free download or in a convenient packaged retail edition, openSUSE 10.3 provides everything a user needs to get started with Linux. To improve the user experience, openSUSE 10.3 includes a flexible Linux-Windows dual-boot configuration, improved user interface, Microsoft* Office file compatibility with the latest OpenOffice.org office productivity suite, and enhanced multimedia support.

“The openSUSE community continues to deliver innovations and has created a new version of openSUSE that will excite a wide range of computer users,” said Andreas Jaeger, director of the openSUSE project. “OpenSUSE 10.3 provides a stable and state-of-the-art operating system based on Linux kernel 2.6.22, and it contains a large variety of the latest open source applications for desktops, servers and application development.”

Enhancements to openSUSE 10.3 include the newest versions of the GNOME* and KDE desktop environments, including a KDE 4 preview. OpenOffice.org 2.3 makes sharing files with Microsoft Office users easy, and the newest version of AppArmor™ protects the Linux operating system and applications from attacks, viruses and malicious applications. OpenSUSE 10.3 also now includes MP3 support out of the box for Banshee™ and Amarok, which are the default media players in openSUSE. In addition, openSUSE 10.3 offers the latest open source applications for developing applications, setting up a home network and running a Web server, as well as the latest virtualization software such as Xen* 3.1 and VirtualBox 1.5.

Version 10.3 makes openSUSE the first Linux distribution to take full advantage of the “1-Click Install” option, which gives openSUSE 10.3 users easy access to many more software packages residing on the openSUSE Build Service. Contributed by a single openSUSE community member, the one-click install is an example of the value openSUSE's strong community of developers, testers, writers, translators, artists and users bring to the distribution. OpenSUSE 10.3 was created by the openSUSE project, the community initiative sponsored by Novell that promotes the use of Linux everywhere. The openSUSE project has more than 54,000 registered members.

Availability and Pricing
OpenSUSE 10.3 is now available for free download at www.opensuse.org. The retail edition of openSUSE 10.3 is available on www.shopnovell.com as well as in select retail locations. It delivers the same packages as the downloadable version on an installable DVD for 32- and 64-bit architectures, and it is accompanied by a second DVD containing a large selection of additional software available at the release date. Also included are a comprehensive user manual and 90 days of installation support, all for a suggested $59.95. For retail locations and more information, visit www.novell.com/products/opensuse/resellers/index.html. For more on openSUSE 10.3 and the openSUSE project, visit www.opensuse.org and news.opensuse.org.