New upstream microreleases 10.19 12.9 13.5, 14.1

Bug #1950268 reported by Christian Ehrhardt 
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
postgresql-10 (Ubuntu)
Invalid
Undecided
Unassigned
Bionic
Fix Released
Undecided
Marc Deslauriers
postgresql-12 (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
Undecided
Marc Deslauriers
postgresql-13 (Ubuntu)
Invalid
Undecided
Unassigned
Hirsute
Fix Released
Undecided
Marc Deslauriers
Impish
Fix Released
Undecided
Marc Deslauriers
Jammy
Won't Fix
Undecided
Unassigned
postgresql-14 (Ubuntu)
Invalid
Undecided
Unassigned
Jammy
Fix Released
Undecided
Unassigned

Bug Description

[Impact]

 * MRE for latest stable fixes of Postgres released on May 2021

[Test Case]

 * The Postgres MREs traditionally rely on the large set of autopkgtests
   to run for verification. In a PPA those are all already pre-checked to
   be good for this upload.

[Regression Potential]

 * Upstreams tests are usually great and in additon in the Archive there
   are plenty of autopkgtests that in the past catched issues before being
   released.
   But never the less there always is a risk for something to break. Since
   these are general stable releases I can't pinpoint them to a most-likely
   area.
   - usually this works smoothly except a few test hickups (flaky) that need to be
     clarified to be sure. Pre-checks will catch those to be discussed upfront (as last time)

[Other Info]

 * This is a reoccurring MRE, see below and all the references
 * CVEs this time:
   - CVE-2021-23214
     Make the server reject extraneous data after an SSL or GSS
     encryption handshake (Tom Lane)
     v10/12/14
   - CVE-2021-23222
     Make <application>libpq</application> reject extraneous data after
     an SSL or GSS encryption handshake (Tom Lane
     v10/12/14

---

Current versions in supported releases that got updates:
 postgresql-10 | 10.18-0ubuntu0.18.04.1 | bionic-updates | source, amd64, arm64, armhf, i386, ppc64el, s390x
 postgresql-12 | 12.8-0ubuntu0.20.04.1 | focal-security | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-13 | 13.4-0ubuntu0.21.04.1 | hirsute-security | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-13 | 13.4-1 | impish | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Special cases:
- jammy is soon synced from Debian as usual (That is 13.5 and 14.1 as a transition has been started there).

Standing MRE - Consider last updates as template:
- pad.lv/1637236
- pad.lv/1664478
- pad.lv/1690730
- pad.lv/1713979
- pad.lv/1730661
- pad.lv/1747676
- pad.lv/1752271
- pad.lv/1786938
- pad.lv/1815665
- pad.lv/1828012
- pad.lv/1833211
- pad.lv/1839058
- pad.lv/1863108
- pad.lv/1892335
- pad.lv/1915254
- pad.lv/1928773
- pad.lv/1939396

As usual we test and prep from the PPA and then push through SRU/Security as applicable.

Tags: server-next

Related branches

CVE References

no longer affects: postgresql-10 (Ubuntu Focal)
no longer affects: postgresql-10 (Ubuntu Hirsute)
no longer affects: postgresql-10 (Ubuntu Impish)
no longer affects: postgresql-10 (Ubuntu Jammy)
no longer affects: postgresql-12 (Ubuntu Bionic)
no longer affects: postgresql-12 (Ubuntu Hirsute)
no longer affects: postgresql-12 (Ubuntu Impish)
no longer affects: postgresql-12 (Ubuntu Jammy)
no longer affects: postgresql-13 (Ubuntu Bionic)
no longer affects: postgresql-13 (Ubuntu Focal)
no longer affects: postgresql-14 (Ubuntu Bionic)
no longer affects: postgresql-14 (Ubuntu Focal)
no longer affects: postgresql-14 (Ubuntu Hirsute)
no longer affects: postgresql-14 (Ubuntu Impish)
Changed in postgresql-10 (Ubuntu):
status: New → Invalid
Changed in postgresql-10 (Ubuntu Bionic):
status: New → Confirmed
Changed in postgresql-12 (Ubuntu Focal):
status: New → Confirmed
Changed in postgresql-13 (Ubuntu Hirsute):
status: New → Confirmed
Changed in postgresql-13 (Ubuntu Impish):
status: New → Confirmed
Changed in postgresql-13 (Ubuntu Jammy):
status: New → Confirmed
Changed in postgresql-14 (Ubuntu Jammy):
status: New → Confirmed
Changed in postgresql-12 (Ubuntu):
status: New → Invalid
tags: added: server-next
Changed in postgresql-13 (Ubuntu Impish):
status: Confirmed → In Progress
Changed in postgresql-13 (Ubuntu Hirsute):
status: Confirmed → In Progress
Changed in postgresql-12 (Ubuntu Focal):
status: Confirmed → In Progress
Changed in postgresql-10 (Ubuntu Bionic):
status: Confirmed → In Progress
assignee: nobody → Christian Ehrhardt  (paelzer)
Changed in postgresql-12 (Ubuntu Focal):
assignee: nobody → Christian Ehrhardt  (paelzer)
Changed in postgresql-13 (Ubuntu Hirsute):
assignee: nobody → Christian Ehrhardt  (paelzer)
Changed in postgresql-13 (Ubuntu Impish):
assignee: nobody → Christian Ehrhardt  (paelzer)
description: updated
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Test results look somewhat ok so far.
The vast majority was successful, the failing ones mostly were known badtests or never ran successfully. The few left worth to look at are:

#1 Bionic - still ongoing as armhf build was stalled

#2 Focal - libpg-perl @ armhf - reset connection
  https://autopkgtest.ubuntu.com/results/autopkgtest-focal-ci-train-ppa-service-4706/focal/armhf/libp/libpg-perl/20211109_172303_63535@/log.gz

#3 Focal - pgagent @ armhf - transient unrelated apt error
  https://autopkgtest.ubuntu.com/results/autopkgtest-focal-ci-train-ppa-service-4706/focal/armhf/p/pgagent/20211109_175558_7ea08@/log.gz

#4 Hirsute - all good

#5 Impish - asterisk @ armhf - transient unrelated apt error
  https://autopkgtest.ubuntu.com/results/autopkgtest-impish-ci-train-ppa-service-4708/impish/armhf/a/asterisk/20211109_140151_9de75@/log.gz

#6 Impish - postgresql-common @ armhf
  https://autopkgtest.ubuntu.com/results/autopkgtest-impish-ci-train-ppa-service-4708/impish/armhf/p/postgresql-common/20211109_153321_fc113@/log.gz

I'll restart #2 - all others are ok.
Will check bionic results once available

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Christian Ehrhardt  (paelzer) wrote (last edit ):

Focal - libpgperl @ armhf
  that was really flaky, two reruns both worked fine
  https://autopkgtest.ubuntu.com/results/autopkgtest-focal-ci-train-ppa-service-4706/focal/armhf/libp/libpg-perl/20211110_091213_212e1@/log.gz

Bionic
After eliminating the badtests and never working tests three are left to look at
libreoffice @ armhf
dovecot @ armhf
asterisk @ armhf
plv8 @ ppc64el
 => https://autopkgtest.ubuntu.com/results/autopkgtest-bionic-ci-train-ppa-service-4705/bionic/ppc64el/p/plv8/20211110_100157_2e92e@/log.gz

The two upper armhf cases are known to be flaky.
Asterisk was a transient apt issue.
plv8 might be interesting

I'll restart them and compare.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Christian Ehrhardt  (paelzer) wrote (last edit ):

On retry a few recovered as expected - dovcot and libreoffice
Asterisk is a non related installability issue and actually always failed.

But plv8 continued to fail and looked suspicious.
Running that in local autopkgtest VMs with and without the new PPA for comparison.

History LGTM
https://autopkgtest.ubuntu.com/packages/p/plv8/bionic/ppc64el

New tests fail reliably
https://autopkgtest.ubuntu.com/results/autopkgtest-bionic-ci-train-ppa-service-4705/bionic/ppc64el/p/plv8/20211110_100157_2e92e@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-bionic-ci-train-ppa-service-4705/bionic/ppc64el/p/plv8/20211110_135629_6fce0@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-bionic-ci-train-ppa-service-4705/bionic/ppc64el/p/plv8/20211110_135634_ece63@/log.gz

The upstream https://github.com/plv8/plv8 is at a much newer version nowadays.
And removed from Debian/Ubuntu since a long time (for issues with v8 AFAIK).

It is clearly working on non ppc64 and even on a ppc64 bare metal retry was fine.
I have asked upstream if they can make sense of it, but will probably file a test hint-for if no solution comes up.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

After many tests on P8 and P9 machines with Containers and VMs of different sizes this plv8 issue really isn't reproducible outside of autopkgtest environemnt. After also checking with upstream (the packagers coordination for a release) we concluded that this shall not stall the release and here will not have to block it either.

I've filed a test hint to reset the test result:
  https://code.launchpad.net/~paelzer/britney/+git/hints-ubuntu/+merge/411737

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Released https://www.postgresql.org/about/news/postgresql-141-135-129-1114-1019-and-9624-released-2349/
Sha256 of the tarballs match, assigning to Marc for releasing this once appropriate in his opinion.

information type: Private Security → Public Security
Changed in postgresql-10 (Ubuntu Bionic):
assignee: Christian Ehrhardt  (paelzer) → Marc Deslauriers (mdeslaur)
Changed in postgresql-12 (Ubuntu Focal):
assignee: Christian Ehrhardt  (paelzer) → Marc Deslauriers (mdeslaur)
Changed in postgresql-13 (Ubuntu Hirsute):
assignee: Christian Ehrhardt  (paelzer) → Marc Deslauriers (mdeslaur)
Changed in postgresql-13 (Ubuntu Impish):
assignee: Christian Ehrhardt  (paelzer) → Marc Deslauriers (mdeslaur)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-10 - 10.19-0ubuntu0.18.04.1

---------------
postgresql-10 (10.19-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * New upstream version (LP: #1950268).

    + Make the server reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23214

    + Make libpq reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23222

    + A dump/restore is not required for those running 10.X.

    + However, note that installations using physical replication should
      update standby servers before the primary server, details in the
      release notes linked below.

    + Also, several bugs have been found that may have resulted in corrupted
      indexes, explained in detail in the release notes linked below. If any
      of those cases apply to you, it's recommended to reindex
      possibly-affected indexes after updating.

    + Also, if you are upgrading from a version earlier than 10.16,
      see those release notes as well please.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/10/release-10-19.html

 -- Christian Ehrhardt <email address hidden> Tue, 09 Nov 2021 09:39:50 +0100

Changed in postgresql-10 (Ubuntu Bionic):
status: In Progress → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-12 - 12.9-0ubuntu0.20.04.1

---------------
postgresql-12 (12.9-0ubuntu0.20.04.1) focal-security; urgency=medium

  * New upstream version (LP: #1950268).

    + Make the server reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23214

    + Make libpq reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23222

    + A dump/restore is not required for those running 12.X.

    + However, note that installations using physical replication should
      update standby servers before the primary server, details in the
      release notes linked below.

    + Also, several bugs have been found that may have resulted in corrupted
      indexes, explained in detail in the release notes linked below. If any
      of those cases apply to you, it's recommended to reindex
      possibly-affected indexes after updating.

    + Also, if you are upgrading from a version earlier than 12.6,
      see those release notes as well please.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/12/release-12-9.html

 -- Christian Ehrhardt <email address hidden> Tue, 09 Nov 2021 09:39:52 +0100

Changed in postgresql-12 (Ubuntu Focal):
status: In Progress → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-13 - 13.5-0ubuntu0.21.04.1

---------------
postgresql-13 (13.5-0ubuntu0.21.04.1) hirsute-security; urgency=medium

  * New upstream version (LP: #1950268).

    + Make the server reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23214

    + Make libpq reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23222

    + A dump/restore is not required for those running 13.X.

    + However, note that installations using physical replication should
      update standby servers before the primary server, details in the
      release notes linked below.

    + Also, several bugs have been found that may have resulted in corrupted
      indexes, explained in detail in the release notes linked below. If any
      of those cases apply to you, it's recommended to reindex
      possibly-affected indexes after updating.

    + Also, if you are upgrading from a version earlier than 13.2,
      see those release notes as well please.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/13/release-13-5.html

 -- Christian Ehrhardt <email address hidden> Tue, 09 Nov 2021 09:39:54 +0100

Changed in postgresql-13 (Ubuntu Hirsute):
status: In Progress → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-13 - 13.5-0ubuntu0.21.10.1

---------------
postgresql-13 (13.5-0ubuntu0.21.10.1) impish-security; urgency=medium

  * New upstream version (LP: #1950268).

    + Make the server reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23214

    + Make libpq reject extraneous data after an SSL or GSS
      encryption handshake
      CVE-2021-23222

    + A dump/restore is not required for those running 13.X.

    + However, note that installations using physical replication should
      update standby servers before the primary server, details in the
      release notes linked below.

    + Also, several bugs have been found that may have resulted in corrupted
      indexes, explained in detail in the release notes linked below. If any
      of those cases apply to you, it's recommended to reindex
      possibly-affected indexes after updating.

    + Also, if you are upgrading from a version earlier than 13.2,
      see those release notes as well please.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/13/release-13-5.html

 -- Christian Ehrhardt <email address hidden> Tue, 09 Nov 2021 09:46:55 +0100

Changed in postgresql-13 (Ubuntu Impish):
status: In Progress → Fix Released
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Jammy 13.x is on the way out transitioning to 14.x -> Won't Fix

Furthermore 14.1 is in proposed now, it will take a while for the many other steps in the full transition, but from this POV of the MRE things are done there.

Changed in postgresql-13 (Ubuntu Jammy):
status: Confirmed → Won't Fix
Changed in postgresql-14 (Ubuntu Jammy):
status: Confirmed → Fix Committed
Changed in postgresql-13 (Ubuntu):
status: Confirmed → Invalid
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

And Steve (thanks) reminded me that reset-tests got superseded by migration-reference/0 (https://lists.ubuntu.com/archives/ubuntu-devel/2021-November/041663.html). So I've done that now and abandoned the hint.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Changed in postgresql-14 (Ubuntu Jammy):
status: Fix Committed → Fix Released
Changed in postgresql-14 (Ubuntu):
status: Fix Committed → Invalid
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.