postgresql-14 (14.15-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2085196).
+ This release encompasses changes from upstream's 14.14 and 14.15
releases. The former contains fixes for 4 CVEs (among other
things), and the latter was hotfix for a problem caused by one of
the CVE fixes from 14.14.
+ A dump/restore is not required for those running 14.X.
+ However, if you are upgrading from a version earlier than 14.12, see
those release notes as well please.
+ Ensure cached plans are marked as dependent on the calling role when
RLS applies to a non-top-level table reference (Nathan Bossart)
If a CTE, subquery, sublink, security invoker view, or coercion
projection in a query references a table with row-level security
policies, we neglected to mark the resulting plan as potentially
dependent on which role is executing it. This could lead to later query
executions in the same session using the wrong plan, and then returning
or hiding rows that should have been hidden or returned instead.
The PostgreSQL Project thanks Wolfgang Walther for reporting this
problem.
(CVE-2024-10976)
+ Make libpq discard error messages
received during SSL or GSS protocol negotiation (Jacob Champion)
An error message received before encryption negotiation is completed
might have been injected by a man-in-the-middle, rather than being real
server output. Reporting it opens the door to various security hazards;
for example, the message might spoof a query result that a careless user
could mistake for correct output. The best answer seems to be to
discard such data and rely only on libpq's own report of the connection
failure.
The PostgreSQL Project thanks Jacob Champion for reporting this
problem.
(CVE-2024-10977)
+ Fix unintended interactions between SET SESSION AUTHORIZATION
and SET ROLE (Tom Lane)
The SQL standard mandates that SET SESSION AUTHORIZATION have a
side-effect of doing SET ROLE NONE. Our implementation of that was
flawed, creating more interaction between the two settings than
intended. Notably, rolling back a transaction that had done SET SESSION
AUTHORIZATION would revert ROLE to NONE even if that had not been the
previous state, so that the effective user ID might now be different
from what it had been before the transaction. Transiently setting
session_authorization in a function SET clause had a similar effect. A
related bug was that if a parallel worker inspected
current_setting('role'), it saw none even when it should see something
else.
The PostgreSQL Project thanks Tom Lane for reporting this problem.
(CVE-2024-10978)
+ Prevent trusted PL/Perl code from changing environment variables
(Andrew Dunstan, Noah Misch)
The ability to manipulate process environment variables such as PATH
gives an attacker opportunities to execute arbitrary code. Therefore,
trustedPLs must not offer the ability to do that. To fix plperl,
replace %ENV with a tied hash that rejects any modification attempt with
a warning. Untrusted plperlu retains the ability to change the
environment.
The PostgreSQL Project thanks Coby Abrams for reporting this problem.
(CVE-2024-10979)
+ Restore functionality of ALTER {ROLE|DATABASE} SET
role (Tom Lane, Noah Misch)
The fix for CVE-2024-10978 accidentally caused settings for role to
not be applied if they come from non-interactive sources, including
previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment
variable.
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-14.html and
https://www.postgresql.org/docs/14/release-14-15.html.
* d/postgresql-14.NEWS: Update.
-- Sergio Durigan Junior <sergio.durigan@canonical.com> Mon, 25 Nov 2024 16:05:41 -0500
postgresql-14 (14.13-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2076183).
+ A dump/restore is not required for those running 14.X.
+ However, if you are upgrading from a version earlier than 14.12, see
those release notes as well please.
+ Prevent unauthorized code execution during pg_dump (Masahiko Sawada)
An attacker able to create and drop non-temporary objects could inject
SQL code that would be executed by a concurrent pg_dump session with the
privileges of the role running pg_dump (which is often a superuser).
The attack involves replacing a sequence or similar object with a view
or foreign table that will execute malicious code. To prevent this,
introduce a new server parameter restrict_nonsystem_relation_kind that
can disable expansion of non-builtin views as well as access to foreign
tables, and teach pg_dump to set it when available. Note that the
attack is prevented only if both pg_dump and the server it is dumping
from are new enough to have this fix.
The PostgreSQL Project thanks Noah Misch for reporting this problem.
(CVE-2024-7348)
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-13.html.
* d/postgresql-14.NEWS: Update.
* d/p/focal-arm64-outline-atomics: refresh patch.
-- Athos Ribeiro <athos.ribeiro@canonical.com> Tue, 06 Aug 2024 15:14:44 -0300
postgresql-14 (14.12-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2067388).
+ A dump/restore is not required for those running 14.X.
+ However, a security vulnerability was found in the system views
pg_stats_ext and pg_stats_ext_exprs, potentially allowing
authenticated database users to see data they shouldn't. If this is of
concern in your installation, follow the steps below to rectify it.
+ Also, if you are upgrading from a version earlier than 14.11, see
those release notes as well please.
+ Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries
to the table owner (Nathan Bossart)
These views failed to hide statistics for expressions that involve
columns the accessing user does not have permission to read. View
columns such as most_common_vals might expose security-relevant
data. The potential interactions here are not fully clear, so in the
interest of erring on the side of safety, make rows in these views
visible only to the owner of the associated table.
The PostgreSQL Project thanks Lukas Fittl for reporting this
problem.
By itself, this fix will only fix the behavior in newly initdb'd
database clusters. If you wish to apply this change in an existing
cluster, you will need to do the following:
- In each database of the cluster, run the
/usr/share/postgresql/14/fix-CVE-2024-4317.sql script as superuser. In
psql this would look like:
i /usr/share/postgresql/14/fix-CVE-2024-4317.sql
It will not hurt to run the script more than once.
- Do not forget to include the template0 and template1 databases,
or the vulnerability will still exist in databases you create
later. To fix template0, you'll need to temporarily make it accept
connections. Do that with:
ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;
and then after fixing template0, undo it with:
ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;
(CVE-2024-4317)
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-12.html
* d/postgresql-14.NEWS: Update.
-- Sergio Durigan Junior <sergio.durigan@canonical.com> Tue, 28 May 2024 09:51:10 -0400
postgresql-14 (14.11-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2052850).
+ A dump/restore is not required for those running 14.X.
+ However, one bug was fixed that could have resulted in corruption of
GIN indexes during concurrent updates. If you suspect such
corruption, reindex affected indexes after installing this update.
+ Also, if you are upgrading from a version earlier than 14.10, see
those release notes as well please.
+ Tighten security restrictions within REFRESH MATERIALIZED
VIEW CONCURRENTLY (Heikki Linnakangas)
One step of a concurrent refresh command was run under weak security
restrictions. If a materialized view's owner could persuade a
superuser or other high-privileged user to perform a concurrent
refresh on that view, the view's owner could control code executed
with the privileges of the user running REFRESH.
Fix things so that all user-determined code is run as the view's
owner, as expected.
The only known exploit for this error does not work in PostgreSQL
16.0 and later, so it may be that v16 is not vulnerable in practice.
The PostgreSQL Project thanks Pedro Gallegos for reporting this
problem.
(CVE-2024-0985)
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-11.html
* d/postgresql-14.NEWS: Update.
-- Sergio Durigan Junior <sergio.durigan@canonical.com> Fri, 09 Feb 2024 19:49:08 -0500
postgresql-14 (14.10-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2040469).
+ A dump/restore is not required for those running 14.X.
+ However, several mistakes have been discovered that could lead to
certain types of indexes yielding wrong search results or being
unnecessarily inefficient. It is advisable to REINDEX
potentially-affected indexes after installing this update.
+ Also, if you are upgrading from a version earlier than 14.9, see
those release notes as well please.
+ Fix handling of unknown-type arguments in DISTINCT "any" aggregate
functions (Tom Lane)
This error led to a text-type value being interpreted as an unknown-type
value (that is, a zero-terminated string) at runtime. This could result
in disclosure of server memory following the text value.
(CVE-2023-5868)
+ Detect integer overflow while computing new array dimensions
(Tom Lane)
When assigning new elements to array subscripts that are outside the
current array bounds, an undetected integer overflow could occur in edge
cases. Memory stomps that are potentially exploitable for arbitrary code
execution are possible, and so is disclosure of server memory.
(CVE-2023-5869)
+ Prevent the <literal>pg_signal_backend</literal> role from
signalling background workers and autovacuum processes (Noah Misch,
Jelte Fennema-Nio)
The documentation says that pg_signal_backend cannot issue signals to
superuser-owned processes. It was able to signal these background
processes, though, because they advertise a role OID of zero. Treat that
as indicating superuser ownership. The security implications of
cancelling one of these process types are fairly small so far as the
core code goes (we'll just start another one), but extensions might add
background workers that are more vulnerable.
Also ensure that the is_superuser parameter is set correctly in such
processes. No specific security consequences are known for that
oversight, but it might be significant for some extensions.
(CVE-2023-5870)
+ Fix misbehavior during recursive page split in GiST index build
(Heikki Linnakangas)
Fix a case where the location of a page downlink was incorrectly
tracked, and introduce some logic to allow recovering from such
situations rather than silently doing the wrong thing. This error
could result in incorrect answers from subsequent index searches.
It may be advisable to reindex all GiST indexes after installing
this update.
+ Prevent de-duplication of btree index entries for interval columns
(Noah Misch)
There are interval values that are distinguishable but compare
equal, for example "24:00:00" and "1 day". This breaks assumptions
made by btree de-duplication, so interval columns need to be excluded
from de-duplication. This oversight can cause incorrect results from
index-only scans. Moreover, after updating amcheck will report an
error for almost all such indexes. Users should reindex any btree
indexes on interval columns.
+ Process date values more sanely in BRIN datetime_minmax_multi_ops
indexes (Tomas Vondra)
The distance calculation for dates was backward, causing poor
decisions about which entries to merge. The index still produces
correct results, but is much less efficient than it should be.
Reindexing BRIN minmax_multi indexes on date columns is advisable.
+ Process large timestamp and timestamptz values more sanely in BRIN
datetime_minmax_multi_ops indexes (Tomas Vondra)
Infinities were mistakenly treated as having distance zero rather
than a large distance from other values, causing poor decisions about
which entries to merge. Also, finite-but-very-large values (near the
endpoints of the representable timestamp range) could result in
internal overflows, again causing poor decisions. The index still
produces correct results, but is much less efficient than it should
be. Reindexing BRIN minmax_multi indexes on timestamp and timestamptz
columns is advisable if the column contains, or has contained,
infinities or large finite values.
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-10.html
* d/p/libpgport-pkglibdir: Adjust patch to reflect upstream changes.
* d/p/50-per-version-dirs.patch: Adjust TestLib.pm's
scan_server_header to account for unrelocatability of
pg_config.
This change replicates what is already being done in the
check_pg_config function. They are needed because, during build time,
we want to be able to run the upstream tests using the pg_config
binary from inside the "debian/" directory, but that doesn't work out
of the box because it will print includedir paths that also point to
"debian/", instead of to "/usr/include". Therefore, we need to catch
this specific scenario and print the proper includedir paths instead.
-- Sergio Durigan Junior <sergio.durigan@canonical.com> Wed, 22 Nov 2023 22:07:12 -0500
postgresql-14 (14.9-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2028426).
+ A dump/restore is not required for those running 14.X.
+ However, if you use BRIN indexes, it may be advisable to reindex them.
+ Also, if you are upgrading from a version earlier than 14.4, see
those release notes as well please.
+ Disallow substituting a schema or owner name into an extension script
if the name contains a quote, backslash, or dollar sign (Noah Misch)
This restriction guards against SQL-injection hazards for trusted
extensions.
(CVE-2023-39417)
+ Fix confusion between empty (no rows) ranges and all-NULL ranges in
BRIN indexes, as well as incorrect merging of all-NULL summaries
(Tomas Vondra)
Each of these oversights could result in forgetting that a BRIN
index range contains any NULL values, potentially allowing
subsequent queries that should return NULL values to miss doing so.
This fix will not in itself correct faulty BRIN entries.
It's recommended to REINDEX any BRIN indexes that
may be used to search for nulls.
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-9.html
-- Athos Ribeiro <athos.ribeiro@canonical.com> Wed, 09 Aug 2023 09:01:25 -0300
postgresql-14 (14.8-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2019214).
+ A dump/restore is not required for those running 14.X.
+ Also, if you are upgrading from a version earlier than 14.4, see
those release notes as well please.
+ Prevent CREATE SCHEMA from defeating changes in search_path
(Alexander Lakhin)
Within a CREATE SCHEMA command, objects in the prevailing
search_path, as well as those in the newly-created schema, would be
visible even within a called function or script that attempted to set
a secure search_path. This could allow any user having permission to
create a schema to hijack the privileges of a security definer
function or extension script.
(CVE-2023-2454)
+ Enforce row-level security policies correctly after inlining a
set-returning function (Stephen Frost, Tom Lane)
If a set-returning SQL-language function refers to a table having
row-level security policies, and it can be inlined into a calling
query, those RLS policies would not get enforced properly in some
cases involving re-using a cached plan under a different role. This
could allow a user to see or modify rows that should have been
invisible.
(CVE-2023-2455)
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-8.html
-- Athos Ribeiro <athos.ribeiro@canonical.com> Tue, 16 May 2023 09:37:37 -0300
postgresql-14 (14.7-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2006406).
+ A dump/restore is not required for those running 14.X.
+ Also, if you are upgrading from a version earlier than 14.4, see
those release notes as well please.
+ libpq can leak memory contents after GSSAPI transport encryption
initiation fails (Jacob Champion).
(CVE-2022-41862)
+ Fix calculation of which GENERATED columns need to be updated in
child tables during an UPDATE on a partitioned table or inheritance
tree (Amit Langote, Tom Lane).
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-7.html
-- Sergio Durigan Junior <sergio.durigan@canonical.com> Thu, 09 Feb 2023 15:18:50 -0500
postgresql-14 (14.6-0ubuntu0.22.04.1) jammy; urgency=medium
* New upstream version (LP: #1996770).
+ A dump/restore is not required for those running 14.X.
+ Also, if you are upgrading from a version earlier than 14.4, see
those release notes as well please.
+ Disallow rules named _RETURN that are not ON SELECT rules (Tom Lane).
+ Fix use-after-free hazard in string comparisons. (Tom Lane)
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-6.html
-- Athos Ribeiro <athos.ribeiro@canonical.com> Thu, 17 Nov 2022 17:11:29 -0300
postgresql-14 (14.5-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #1984012).
+ A dump/restore is not required for those running 14.X.
+ Also, if you are upgrading from a version earlier than 14.4, see
those release notes as well please.
+ Do not let extension scripts replace objects not already belonging
to the extension (Tom Lane).
(CVE-2022-2625)
+ Do not let extension scripts replace objects not already belonging
to the extension (Tom Lane).
+ Fix permissions checks in CREATE INDEX (Nathan Bossart,
Noah Misch).
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-5.html
-- Sergio Durigan Junior <sergio.durigan@canonical.com> Mon, 08 Aug 2022 18:15:57 -0400
# For older changelog entries, run 'apt-get changelog libpq5'
Generated by dwww version 1.14 on Sat Jan 25 21:50:32 CET 2025.