PostgreSQL: CVE-2020-21469 is not a security vulnerability

[NewsBot]

A new PostgreSQL blog post/announcement has been posted!

The PostgreSQL Security Team was made aware of CVE-2020-21469, which was filed without the prior knowledge of the PostgreSQL Security Team.

THIS IS NOT A SECURITY VULNERABILITY.

The CVE claims that it's possible to create a denial-of-service in a PostgreSQL 12.2 by sending repeated SIGHUP (or reload) signals to the primary PostgreSQL process. However, to do this, you need to have an account that is explicitly granted elevated privileges, including:

• A PostgreSQL superuser (postgres).
• A user that was granted permission to execute pg_reload_conf by a PostgreSQL superuser.
• Access to a privileged operating system user

If you are still running PostgreSQL 12.2, we do strongly encourage to upgrade to a newer release because of https://www.postgresql.org/about/news/cve-2020-21469-is-not-a-security-vulnerability-2701/