Change log for postgresql-14 package in Ubuntu
| 1 → 30 of 30 results | First • Previous • Next • Last |
postgresql-14 (14.11-0ubuntu0.22.04.1) jammy-security; urgency=medium * New upstream version (LP: #2052850). + A dump/restore is not required for those running 14.X. + However, one bug was fixed that could have resulted in corruption of GIN indexes during concurrent updates. If you suspect such corruption, reindex affected indexes after installing this update. + Also, if you are upgrading from a version earlier than 14.10, see those release notes as well please. + Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (Heikki Linnakangas) One step of a concurrent refresh command was run under weak security restrictions. If a materialized view's owner could persuade a superuser or other high-privileged user to perform a concurrent refresh on that view, the view's owner could control code executed with the privileges of the user running REFRESH. Fix things so that all user-determined code is run as the view's owner, as expected. The only known exploit for this error does not work in PostgreSQL 16.0 and later, so it may be that v16 is not vulnerable in practice. The PostgreSQL Project thanks Pedro Gallegos for reporting this problem. (CVE-2024-0985) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-11.html * d/postgresql-14.NEWS: Update. -- Sergio Durigan Junior <email address hidden> Fri, 09 Feb 2024 19:49:08 -0500
Available diffs
postgresql-14 (14.10-0ubuntu0.22.04.1) jammy-security; urgency=medium * New upstream version (LP: #2040469). + A dump/restore is not required for those running 14.X. + However, several mistakes have been discovered that could lead to certain types of indexes yielding wrong search results or being unnecessarily inefficient. It is advisable to REINDEX potentially-affected indexes after installing this update. + Also, if you are upgrading from a version earlier than 14.9, see those release notes as well please. + Fix handling of unknown-type arguments in DISTINCT "any" aggregate functions (Tom Lane) This error led to a text-type value being interpreted as an unknown-type value (that is, a zero-terminated string) at runtime. This could result in disclosure of server memory following the text value. (CVE-2023-5868) + Detect integer overflow while computing new array dimensions (Tom Lane) When assigning new elements to array subscripts that are outside the current array bounds, an undetected integer overflow could occur in edge cases. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. (CVE-2023-5869) + Prevent the <literal>pg_signal_backend</literal> role from signalling background workers and autovacuum processes (Noah Misch, Jelte Fennema-Nio) The documentation says that pg_signal_backend cannot issue signals to superuser-owned processes. It was able to signal these background processes, though, because they advertise a role OID of zero. Treat that as indicating superuser ownership. The security implications of cancelling one of these process types are fairly small so far as the core code goes (we'll just start another one), but extensions might add background workers that are more vulnerable. Also ensure that the is_superuser parameter is set correctly in such processes. No specific security consequences are known for that oversight, but it might be significant for some extensions. (CVE-2023-5870) + Fix misbehavior during recursive page split in GiST index build (Heikki Linnakangas) Fix a case where the location of a page downlink was incorrectly tracked, and introduce some logic to allow recovering from such situations rather than silently doing the wrong thing. This error could result in incorrect answers from subsequent index searches. It may be advisable to reindex all GiST indexes after installing this update. + Prevent de-duplication of btree index entries for interval columns (Noah Misch) There are interval values that are distinguishable but compare equal, for example "24:00:00" and "1 day". This breaks assumptions made by btree de-duplication, so interval columns need to be excluded from de-duplication. This oversight can cause incorrect results from index-only scans. Moreover, after updating amcheck will report an error for almost all such indexes. Users should reindex any btree indexes on interval columns. + Process date values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra) The distance calculation for dates was backward, causing poor decisions about which entries to merge. The index still produces correct results, but is much less efficient than it should be. Reindexing BRIN minmax_multi indexes on date columns is advisable. + Process large timestamp and timestamptz values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra) Infinities were mistakenly treated as having distance zero rather than a large distance from other values, causing poor decisions about which entries to merge. Also, finite-but-very-large values (near the endpoints of the representable timestamp range) could result in internal overflows, again causing poor decisions. The index still produces correct results, but is much less efficient than it should be. Reindexing BRIN minmax_multi indexes on timestamp and timestamptz columns is advisable if the column contains, or has contained, infinities or large finite values. + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-10.html * d/p/libpgport-pkglibdir: Adjust patch to reflect upstream changes. * d/p/50-per-version-dirs.patch: Adjust TestLib.pm's scan_server_header to account for unrelocatability of pg_config. This change replicates what is already being done in the check_pg_config function. They are needed because, during build time, we want to be able to run the upstream tests using the pg_config binary from inside the "debian/" directory, but that doesn't work out of the box because it will print includedir paths that also point to "debian/", instead of to "/usr/include". Therefore, we need to catch this specific scenario and print the proper includedir paths instead. -- Sergio Durigan Junior <email address hidden> Wed, 22 Nov 2023 22:07:12 -0500
Available diffs
postgresql-14 (14.9-0ubuntu0.22.04.1) jammy-security; urgency=medium * New upstream version (LP: #2028426). + A dump/restore is not required for those running 14.X. + However, if you use BRIN indexes, it may be advisable to reindex them. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + Disallow substituting a schema or owner name into an extension script if the name contains a quote, backslash, or dollar sign (Noah Misch) This restriction guards against SQL-injection hazards for trusted extensions. (CVE-2023-39417) + Fix confusion between empty (no rows) ranges and all-NULL ranges in BRIN indexes, as well as incorrect merging of all-NULL summaries (Tomas Vondra) Each of these oversights could result in forgetting that a BRIN index range contains any NULL values, potentially allowing subsequent queries that should return NULL values to miss doing so. This fix will not in itself correct faulty BRIN entries. It's recommended to REINDEX any BRIN indexes that may be used to search for nulls. + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-9.html -- Athos Ribeiro <email address hidden> Wed, 09 Aug 2023 09:01:25 -0300
Available diffs
postgresql-14 (14.8-0ubuntu0.22.04.1) jammy-security; urgency=medium * New upstream version (LP: #2019214). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + Prevent CREATE SCHEMA from defeating changes in search_path (Alexander Lakhin) Within a CREATE SCHEMA command, objects in the prevailing search_path, as well as those in the newly-created schema, would be visible even within a called function or script that attempted to set a secure search_path. This could allow any user having permission to create a schema to hijack the privileges of a security definer function or extension script. (CVE-2023-2454) + Enforce row-level security policies correctly after inlining a set-returning function (Stephen Frost, Tom Lane) If a set-returning SQL-language function refers to a table having row-level security policies, and it can be inlined into a calling query, those RLS policies would not get enforced properly in some cases involving re-using a cached plan under a different role. This could allow a user to see or modify rows that should have been invisible. (CVE-2023-2455) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-8.html -- Athos Ribeiro <email address hidden> Tue, 16 May 2023 09:37:37 -0300
Available diffs
postgresql-14 (14.8-0ubuntu0.22.10.1) kinetic-security; urgency=medium * New upstream version (LP: #2019214). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + Prevent CREATE SCHEMA from defeating changes in search_path (Alexander Lakhin) Within a CREATE SCHEMA command, objects in the prevailing search_path, as well as those in the newly-created schema, would be visible even within a called function or script that attempted to set a secure search_path. This could allow any user having permission to create a schema to hijack the privileges of a security definer function or extension script. (CVE-2023-2454) + Enforce row-level security policies correctly after inlining a set-returning function (Stephen Frost, Tom Lane) If a set-returning SQL-language function refers to a table having row-level security policies, and it can be inlined into a calling query, those RLS policies would not get enforced properly in some cases involving re-using a cached plan under a different role. This could allow a user to see or modify rows that should have been invisible. (CVE-2023-2455) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-8.html -- Athos Ribeiro <email address hidden> Tue, 16 May 2023 09:10:45 -0300
Available diffs
postgresql-14 (14.7-0ubuntu0.22.10.1) kinetic-security; urgency=medium * New upstream version (LP: #2006406). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + libpq can leak memory contents after GSSAPI transport encryption initiation fails (Jacob Champion). (CVE-2022-41862) + Fix calculation of which GENERATED columns need to be updated in child tables during an UPDATE on a partitioned table or inheritance tree (Amit Langote, Tom Lane). + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-7.html -- Sergio Durigan Junior <email address hidden> Thu, 09 Feb 2023 15:24:34 -0500
Available diffs
postgresql-14 (14.7-0ubuntu0.22.04.1) jammy-security; urgency=medium * New upstream version (LP: #2006406). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + libpq can leak memory contents after GSSAPI transport encryption initiation fails (Jacob Champion). (CVE-2022-41862) + Fix calculation of which GENERATED columns need to be updated in child tables during an UPDATE on a partitioned table or inheritance tree (Amit Langote, Tom Lane). + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-7.html -- Sergio Durigan Junior <email address hidden> Thu, 09 Feb 2023 15:18:50 -0500
Available diffs
postgresql-14 (14.6-0ubuntu0.22.04.1) jammy; urgency=medium * New upstream version (LP: #1996770). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + Disallow rules named _RETURN that are not ON SELECT rules (Tom Lane). + Fix use-after-free hazard in string comparisons. (Tom Lane) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-6.html -- Athos Ribeiro <email address hidden> Thu, 17 Nov 2022 17:11:29 -0300
postgresql-14 (14.6-0ubuntu0.22.10.1) kinetic; urgency=medium * New upstream version (LP: #1996770). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + Disallow rules named _RETURN that are not ON SELECT rules (Tom Lane). + Fix use-after-free hazard in string comparisons. (Tom Lane) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-6.html -- Athos Ribeiro <email address hidden> Thu, 17 Nov 2022 16:42:48 -0300
Available diffs
| Deleted in lunar-proposed (Reason: 14.5-1 in lunar is the last we need as the transition to ...) |
postgresql-14 (14.6-0ubuntu1) lunar; urgency=medium * New upstream version (LP: #1996770). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + Disallow rules named _RETURN that are not ON SELECT rules. + Fix use-after-free hazard in string comparisons. (Tom Lane) + Fix incompatibilities with LLVM 15. (Thomas Munro, Andres Freund) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-6.html * d/control: remove strict dependency on llvm-14-dev/clang-14 now that LLVM 15 support is available. -- Athos Ribeiro <email address hidden> Wed, 16 Nov 2022 12:49:39 -0300
Available diffs
- diff from 14.5-1ubuntu2 to 14.6-0ubuntu1 (1.5 MiB)
| Superseded in lunar-proposed |
postgresql-14 (14.5-1ubuntu2) lunar; urgency=medium * Rebuild against new perlapi-5.36. -- Gianfranco Costamagna <email address hidden> Fri, 04 Nov 2022 22:00:42 +0100
Available diffs
- diff from 14.5-1ubuntu1 to 14.5-1ubuntu2 (367 bytes)
| Deleted in lunar-release (Reason: (From Debian) ROM; superseded by postgresql-15; Debian bu...) |
| Obsolete in kinetic-release |
| Deleted in kinetic-proposed (Reason: Moved to kinetic) |
postgresql-14 (14.5-1ubuntu1) kinetic; urgency=medium * d/control: Fix FTBFS by depending on llvm-14-dev/clang-14 for now -- Christian Ehrhardt <email address hidden> Tue, 20 Sep 2022 09:41:03 +0200
Available diffs
- diff from 14.5-1 (in Debian) to 14.5-1ubuntu1 (785 bytes)
postgresql-14 (14.5-0ubuntu0.22.04.1) jammy-security; urgency=medium * New upstream version (LP: #1984012). + A dump/restore is not required for those running 14.X. + Also, if you are upgrading from a version earlier than 14.4, see those release notes as well please. + Do not let extension scripts replace objects not already belonging to the extension (Tom Lane). (CVE-2022-2625) + Do not let extension scripts replace objects not already belonging to the extension (Tom Lane). + Fix permissions checks in CREATE INDEX (Nathan Bossart, Noah Misch). + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-5.html -- Sergio Durigan Junior <email address hidden> Mon, 08 Aug 2022 18:15:57 -0400
Available diffs
postgresql-14 (14.5-1) unstable; urgency=medium
* New upstream version.
+ Do not let extension scripts replace objects not already belonging to
the extension (Tom Lane) (CVE-2022-2625)
This change prevents extension scripts from doing CREATE OR REPLACE if
there is an existing object that does not belong to the extension. It
also prevents CREATE IF NOT EXISTS in the same situation. This prevents
a form of trojan-horse attack in which a hostile database user could
become the owner of an extension object and then modify it to compromise
future uses of the object by other users. As a side benefit, it also
reduces the risk of accidentally replacing objects one did not mean to.
The PostgreSQL Project thanks Sven Klemm for reporting this problem.
* Update lintian overrides.
-- Christoph Berg <email address hidden> Wed, 10 Aug 2022 14:45:40 +0200
Available diffs
- diff from 14.4-1 to 14.5-1 (1.4 MiB)
postgresql-14 (14.4-0ubuntu0.22.04.1) jammy; urgency=medium * New upstream version (LP: #1978249). + A dump/restore is not required for those running 14.X. + However, if you have any indexes that were created using the CONCURRENTLY option under 14.X, you should re-index them after updating. See the upstream changelog linked below for further information. + Also, if you are upgrading from a version earlier than 14.3, see those release notes as well please. + Prevent possible corruption of indexes created or rebuilt with the CONCURRENTLY option (Álvaro Herrera). An optimization added in v14 caused CREATE INDEX ... CONCURRENTLY and REINDEX ... CONCURRENTLY to sometimes miss indexing rows that were updated during the index build. Revert that optimization. It is recommended that any indexes made with the CONCURRENTLY option be rebuilt after installing this update. (Alternatively, rebuild them without CONCURRENTLY.) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-4.html -- Sergio Durigan Junior <email address hidden> Fri, 17 Jun 2022 12:00:44 -0400
Available diffs
postgresql-14 (14.4-1) unstable; urgency=medium
* New upstream release.
+ Prevent possible corruption of indexes created or rebuilt with the
CONCURRENTLY option (Álvaro Herrera)
An optimization added in v14 caused CREATE INDEX ... CONCURRENTLY and
REINDEX ... CONCURRENTLY to sometimes miss indexing rows that were
updated during the index build. Revert that optimization. It is
recommended that any indexes made with the CONCURRENTLY option be
rebuilt after installing this update. (Alternatively, rebuild them
without CONCURRENTLY.)
-- Christoph Berg <email address hidden> Tue, 14 Jun 2022 09:49:41 +0200
Available diffs
- diff from 14.3-1 to 14.4-1 (934.5 KiB)
postgresql-14 (14.3-0ubuntu0.22.04.1) jammy-security; urgency=medium * New upstream version (LP: #1973627). + A dump/restore is not required for those running 14.X. + However, if you have any GiST indexes on columns of type ltree (supplied by the contrib/ltree extension), you should re-index them after updating. See the upstream changelog linked below for further information. + Also, if you are upgrading from a version earlier than 14.2, see those release notes as well please. + Confine additional operations within "security restricted operation" sandboxes (Sergey Shinderuk, Noah Misch). Autovacuum, CLUSTER, CREATE INDEX, REINDEX, REFRESH MATERIALIZED VIEW, and pg_amcheck activated the "security restricted operation" protection mechanism too late, or even not at all in some code paths. A user having permission to create non-temporary objects within a database could define an object that would execute arbitrary SQL code with superuser permissions the next time that autovacuum processed the object, or that some superuser ran one of the affected commands against it. The PostgreSQL Project thanks Alexander Lakhin for reporting this problem. (CVE-2022-1552) + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-3.html * d/p/llvm14-support.patch: drop patch applied upstream. -- Athos Ribeiro <email address hidden> Mon, 16 May 2022 16:17:01 -0300
Available diffs
postgresql-14 (14.3-1) unstable; urgency=medium
* New upstream release.
* Confine additional operations within security restricted operation
sandboxes (Sergey Shinderuk, Noah Misch)
Autovacuum, CLUSTER, CREATE INDEX, REINDEX, REFRESH MATERIALIZED VIEW,
and pg_amcheck activated the security restricted operation protection
mechanism too late, or even not at all in some code paths. A user having
permission to create non-temporary objects within a database could
define an object that would execute arbitrary SQL code with superuser
permissions the next time that autovacuum processed the object, or that
some superuser ran one of the affected commands against it.
The PostgreSQL Project thanks Alexander Lakhin for reporting this
problem. (CVE-2022-1552)
* Fix default signature length for gist_ltree_ops indexes
(Tomas Vondra, Alexander Korotkov)
The default signature length (hash size) for GiST indexes on ltree
columns was accidentally changed while upgrading that operator class to
support operator class parameters. If any operations had been done on
such an index without first upgrading the ltree extension to version
1.2, they were done assuming that the signature length was 28 bytes
rather than the intended 8. This means it is very likely that such
indexes are now corrupt. For safety we recommend re-indexing all GiST
indexes on ltree columns after installing this update. (Note that GiST
indexes on ltree[] columns, that is arrays of ltree, are not affected.)
-- Christoph Berg <email address hidden> Tue, 10 May 2022 10:34:28 +0200
Available diffs
postgresql-14 (14.2-1ubuntu2) kinetic; urgency=medium * No-change rebuild against latest icu -- Jeremy Bicha <email address hidden> Fri, 29 Apr 2022 11:33:14 -0400
Available diffs
- diff from 14.2-1ubuntu1 to 14.2-1ubuntu2 (358 bytes)
| Superseded in kinetic-release |
| Published in jammy-release |
| Deleted in jammy-proposed (Reason: Moved to jammy) |
postgresql-14 (14.2-1ubuntu1) jammy; urgency=medium * d/p/llvm14-support.patch: fix FTBFS with llvm-14 (LP: #1966319) -- Andreas Hasenack <email address hidden> Fri, 25 Mar 2022 11:34:41 -0300
Available diffs
postgresql-14 (14.2-1) unstable; urgency=medium * New upstream release. -- Christoph Berg <email address hidden> Wed, 09 Feb 2022 10:39:43 +0100
Available diffs
| Superseded in jammy-proposed |
postgresql-14 (14.1-5build3) jammy; urgency=medium * No-change rebuild for icu soname change. -- Matthias Klose <email address hidden> Wed, 09 Feb 2022 15:17:04 +0100
Available diffs
- diff from 14.1-5build2 to 14.1-5build3 (312 bytes)
| Superseded in jammy-proposed |
postgresql-14 (14.1-5build2) jammy; urgency=medium * No-change rebuild for the perl update. -- Matthias Klose <email address hidden> Sun, 06 Feb 2022 14:47:39 +0100
Available diffs
- diff from 14.1-5build1 to 14.1-5build2 (330 bytes)
| Superseded in jammy-proposed |
postgresql-14 (14.1-5build1) jammy; urgency=medium * No-change rebuild with Python 3.10 as default version -- Graham Inggs <email address hidden> Fri, 14 Jan 2022 11:38:13 +0000
Available diffs
- diff from 14.1-5 (in Debian) to 14.1-5build1 (349 bytes)
postgresql-14 (14.1-5) unstable; urgency=medium
* Provide postgresql-14-jit-llvm (= ${llvm:Version}) so extensions can
depend on a matching llvm version.
-- Christoph Berg <email address hidden> Mon, 03 Jan 2022 16:08:18 +0100
Available diffs
- diff from 14.1-4 to 14.1-5 (551 bytes)
postgresql-14 (14.1-4) unstable; urgency=medium
[ Christoph Berg ]
* Disable LLVM JIT on s390x for now. (See #1002029)
[ Christian Ehrhardt ]
* postgresql-common/server/postgresql.mk: avoid gcc 11 ICE on armhf and
armel.
-- Christoph Berg <email address hidden> Mon, 20 Dec 2021 18:21:21 +0100
Available diffs
| Superseded in jammy-release |
| Deleted in jammy-proposed (Reason: Moved to jammy) |
| Superseded in jammy-proposed |
postgresql-14 (14.1-1ubuntu1) jammy; urgency=medium
* d/rules: Work around an ICE in latest GCC for armhf, see
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103395 (LP: #1953128)
-- Simon Chopin <email address hidden> Thu, 02 Dec 2021 13:37:16 +0100
Available diffs
- diff from 14.1-1build1 to 14.1-1ubuntu1 (836 bytes)
| Superseded in jammy-proposed |
postgresql-14 (14.1-1build1) jammy; urgency=medium * No-change rebuild against openssl3 -- Simon Chopin <email address hidden> Thu, 02 Dec 2021 10:59:22 +0100
Available diffs
- diff from 14.1-1 (in Debian) to 14.1-1build1 (319 bytes)
postgresql-14 (14.1-1) unstable; urgency=medium
* New upstream release.
+ Make the server and libpq reject extraneous data after an SSL or GSS
encryption handshake (Tom Lane)
A man-in-the-middle with the ability to inject data into the TCP
connection could stuff some cleartext data into the start of a
supposedly encryption-protected database session.
This could be abused to send faked SQL commands to the server, although
that would only work if the server did not demand any authentication
data. (However, a server relying on SSL certificate authentication
might well not do so.) (CVE-2021-23214)
This could probably be abused to inject faked responses to the client's
first few queries, although other details of libpq's behavior make that
harder than it sounds. A different line of attack is to exfiltrate the
client's password, or other sensitive data that might be sent early in
the session. That has been shown to be possible with a server
vulnerable to CVE-2021-23214. (CVE-2021-23222)
The PostgreSQL Project thanks Jacob Champion for reporting these
problems.
* libpq-dev: Depend on libssl-dev, `pkg-config --exists libpq` requires it.
-- Christoph Berg <email address hidden> Fri, 05 Nov 2021 12:05:46 +0100
Available diffs
- diff from 14.0-1 to 14.1-1 (1.5 MiB)
postgresql-14 (14.0-1) unstable; urgency=medium
* First PG14 release.
* Depend on postgresql-common 229 for scram-sha-256 authentication by
default.
-- Christoph Berg <email address hidden> Tue, 28 Sep 2021 13:56:00 +0200
| 1 → 30 of 30 results | First • Previous • Next • Last |
