postgresqlNN: updated to 12.3, 11.8, 10.13, 9.6.18, and 9.5.22
PostgreSQL 12.3, 11.8, 10.13, 9.6.18, and 9.5.22 Released!
Posted on 2020-05-14 by PostgreSQL Global Development Group
The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 12.3, 11.8, 10.13, 9.6.18, and 9.5.22. This release fixes one security issue found in the PostgreSQL server and over 75 bugs reported over the last three months.
Please plan to update at your earliest convenience.
Security Issues
CVE-2020-10733: Windows installer runs executables from uncontrolled directories.
Versions Affected: 9.5 - 12. The security team does not test unsupported versions, but this issue existed before PostgreSQL 9.5.
The Windows installer for PostgreSQL invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.
The PostgreSQL project thanks Hou JingYi (@hjy79425575) for reporting this problem.
Bug Fixes and Improvements
This update also fixes over 75 bugs that were reported in the last several months. Some of these issues affect only version 12, but may also affect all supported versions.
Some of these fixes include:
Several fixes for GENERATED columns, including an issue where it was possible to crash or corrupt data in a table when the output of the generated column was the exact copy of a physical column on the table, e.g. if the expression called a function which could return its own input.
Several fixes for ALTER TABLE, including ensuring the SET STORAGE directive is propagated to a table's indexes.
Fix a potential race condition when using DROP OWNED BY while another session is deleting the same objects.
Allow for a partition to be detached when it has inherited ROW triggers.
Several fixes for REINDEX CONCURRENTLY, particularly with issues when a REINDEX CONCURRENTLY operation fails.
Fix crash when COLLATE is applied to an uncollatable type in a partition bound expression.
Fix performance regression in floating point overflow/underflow detection.
Several fixes for full text search, particularly with phrase searching.
Fix query-lifespan memory leak for a set-returning function used in a query's FROM clause.
Several reporting fixes for the output of VACUUM VERBOSE.
Allow input of type circle to accept the format (x,y),r, which is specified in the documentation.
Allow for the get_bit() and set_bit() functions to not fail on bytea strings longer than 256MB.
Avoid premature recycling of WAL segments during crash recovery, which could lead to WAL segments being recycled before being archived.
Avoid attempting to fetch nonexistent WAL files from archive storage during recovery by skipping irrelevant timelines.
Several fixes for logical replication and replication slots.
Fix several race conditions in synchronous standby management, including one that occurred when changing the synchronous_standby_names setting.
Several fixes for GSSAPI support, include a fix for a memory leak that occurred when using GSSAPI encryption.
Ensure that members of the pg_read_all_stats role can read all statistics views.
Fix performance regression in information_schema.triggers view.
Fix memory leak in libpq when using sslmode=verify-full.
Fix crash in psql when attempting to re-establish a failed connection.
Allow tab-completion of the filename argument to \gx command in psql.
Add pg_dump support for ALTER ... DEPENDS ON EXTENSION.
Several other fixes for pg_dump, which include dumping comments on RLS policies and postponing restore of event triggers until the end.
Ensure pg_basebackup generates valid tar files.
pg_checksums skips tablespace subdirectories that belong to a different PostgreSQL major version
Several Windows compatibility fixes
This update also contains tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.
2020-05-15 11:45:00 +02:00
|
|
|
$NetBSD: distinfo,v 1.24 2020/05/15 09:45:01 adam Exp $
|
2016-02-25 22:37:35 +01:00
|
|
|
|
postgresqlNN: updated to 12.3, 11.8, 10.13, 9.6.18, and 9.5.22
PostgreSQL 12.3, 11.8, 10.13, 9.6.18, and 9.5.22 Released!
Posted on 2020-05-14 by PostgreSQL Global Development Group
The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 12.3, 11.8, 10.13, 9.6.18, and 9.5.22. This release fixes one security issue found in the PostgreSQL server and over 75 bugs reported over the last three months.
Please plan to update at your earliest convenience.
Security Issues
CVE-2020-10733: Windows installer runs executables from uncontrolled directories.
Versions Affected: 9.5 - 12. The security team does not test unsupported versions, but this issue existed before PostgreSQL 9.5.
The Windows installer for PostgreSQL invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.
The PostgreSQL project thanks Hou JingYi (@hjy79425575) for reporting this problem.
Bug Fixes and Improvements
This update also fixes over 75 bugs that were reported in the last several months. Some of these issues affect only version 12, but may also affect all supported versions.
Some of these fixes include:
Several fixes for GENERATED columns, including an issue where it was possible to crash or corrupt data in a table when the output of the generated column was the exact copy of a physical column on the table, e.g. if the expression called a function which could return its own input.
Several fixes for ALTER TABLE, including ensuring the SET STORAGE directive is propagated to a table's indexes.
Fix a potential race condition when using DROP OWNED BY while another session is deleting the same objects.
Allow for a partition to be detached when it has inherited ROW triggers.
Several fixes for REINDEX CONCURRENTLY, particularly with issues when a REINDEX CONCURRENTLY operation fails.
Fix crash when COLLATE is applied to an uncollatable type in a partition bound expression.
Fix performance regression in floating point overflow/underflow detection.
Several fixes for full text search, particularly with phrase searching.
Fix query-lifespan memory leak for a set-returning function used in a query's FROM clause.
Several reporting fixes for the output of VACUUM VERBOSE.
Allow input of type circle to accept the format (x,y),r, which is specified in the documentation.
Allow for the get_bit() and set_bit() functions to not fail on bytea strings longer than 256MB.
Avoid premature recycling of WAL segments during crash recovery, which could lead to WAL segments being recycled before being archived.
Avoid attempting to fetch nonexistent WAL files from archive storage during recovery by skipping irrelevant timelines.
Several fixes for logical replication and replication slots.
Fix several race conditions in synchronous standby management, including one that occurred when changing the synchronous_standby_names setting.
Several fixes for GSSAPI support, include a fix for a memory leak that occurred when using GSSAPI encryption.
Ensure that members of the pg_read_all_stats role can read all statistics views.
Fix performance regression in information_schema.triggers view.
Fix memory leak in libpq when using sslmode=verify-full.
Fix crash in psql when attempting to re-establish a failed connection.
Allow tab-completion of the filename argument to \gx command in psql.
Add pg_dump support for ALTER ... DEPENDS ON EXTENSION.
Several other fixes for pg_dump, which include dumping comments on RLS policies and postponing restore of event triggers until the end.
Ensure pg_basebackup generates valid tar files.
pg_checksums skips tablespace subdirectories that belong to a different PostgreSQL major version
Several Windows compatibility fixes
This update also contains tzdata release 2020a for DST law changes in Morocco and the Canadian Yukon, plus historical corrections for Shanghai. The America/Godthab zone has been renamed to America/Nuuk to reflect current English usage ; however, the old name remains available as a compatibility link. This also updates initdb's list of known Windows time zone names to include recent additions.
2020-05-15 11:45:00 +02:00
|
|
|
SHA1 (postgresql-9.5.22.tar.bz2) = 5f67ef49a6751293f999db48b60dc91338735a79
|
|
|
|
|
RMD160 (postgresql-9.5.22.tar.bz2) = 3a2b8b26d73f4fa5a47f538b0cdef35d697f5101
|
|
|
|
|
SHA512 (postgresql-9.5.22.tar.bz2) = 489321fa49e17308d3a78353edf73a16295c1377ad429a94636df069d2bf55f538ba6570e3d2991dd28bcca45fee77c6c41fa9bade35ea7f9e581abff4c9a401
|
|
|
|
|
Size (postgresql-9.5.22.tar.bz2) = 17667386 bytes
|
2016-02-25 22:37:35 +01:00
|
|
|
SHA1 (patch-config_missing) = c2d7d742922ba6861e7660c75b7b53f09e564813
|
postgresql: updated to 10.2, 9.6.7, 9.5.11, 9.4.16, and 9.3.21
This release fixes two security issues. This release also fixes issues with VACUUM, GIN indexes, and hash indexes that could lead to data corruption, as well as fixes for using parallel queries and logical replication.
Security Issues
* CVE-2018-1052: Fix the processing of partition keys containing multiple expressions
* CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable
Bug Fixes and Improvements
* Fix crash and potential disclosure of backend memory when processing partition keys containing multiple expressions
* Fix potential disclosure of temporary files containing database passwords created by pg_upgrade by not allowing these files to be world-accessible
* Fix cases where VACUUM would not remove dead rows if they were updated while "key-share" locked, leading to potential data corruption
* Fix for GIN indexes to prevent bloat by ensuring the pending-insertions list is cleaned up by VACUUM
* Fix potential index corruption with hash indexes due to failure to mark metapages as dirty
* Fix several potential crash scenarios for parallel queries, including when a bitmap heap scan cannot allocate memory
* Fix several potential hang-ups in parallel queries, including when a parallel worker fails to start
* Fix collection of EXPLAIN statistics from parallel workers
* Prevent fake deadlock failures when multiple sessions are running CREATE INDEX CONCURRENTLY
* Fix for trigger behavior when using logical replication
* Several fixes for "walsender" functionality to improve stability as well as visibility into the replication process
* Fix logical decoding to correctly clean up disk files for crashed transactions
* Several fixes for identity columns, including disallowing identity columns on tables derived from composite types and partitions
* Fix handling of list partitioning constraints for partition keys of boolean and array types
* Fix incorrectly generated plans for UPDATE and DELETE queries when a table has a mix of inherited regular and foreign child tables
* Fix incorrect query results from cases involving GROUPING SETS when used with flattened subqueries
* Fix UNION/INTERSECT/EXCEPT over zero columns, e.g. "SELECT UNION SELECT;"
* Several fixes for subqueries within a LATERAL subquery
* Several improvements for query planning estimation
* Allow a client that supports SCRAM channel binding, such as a future version of PostgreSQL or libpq, to connect to a PostgreSQL 10 server
* Fix sample INSTR() functions used to help transition from Oracle(r) PL/SQL to PostgreSQL PL/pgSQL to correctly match Oracle functional behavior
* Fix pg_dump to make permissions (ACL), security label, and comment entries reliably identifiable in archive outputs
* Modify behavior for contrib/cube's "cube ~> int" operator to make it compatible with KNN search. This is a backwards incompatible change and any expression indexes or materialized views using this operator will need to be reindexed and refreshed, respectively.
* Several fixes in contrib/postgres_fdw to prevent query planner errors
* Added modern examples of auto-start scripts for PostgreSQL on macOS in the contrib/start-scripts/macos directory
* Several fixes for Windows, including postmaster startup and compatibility with libperl
* Spinlock fixes and support for Motorola 68K and 88K architectures
2018-02-08 21:53:56 +01:00
|
|
|
SHA1 (patch-config_perl.m4) = 14c9564577d0df6f82ae0027aeada2f3a6a8f07c
|
|
|
|
|
SHA1 (patch-configure) = 18dd4af7f043b090beda157dfd52531b551eafd0
|
2016-02-25 22:37:35 +01:00
|
|
|
SHA1 (patch-contrib_dblink_dblink.c) = a6f87ab9f2c28a72608d70267b71bd77437b0921
|
|
|
|
|
SHA1 (patch-src_Makefile.global.in) = 2ab3affedc77b202f6749964287438d6179ca23a
|
2018-01-22 12:05:29 +01:00
|
|
|
SHA1 (patch-src_Makefile.shlib) = a809ef756e9314723476fe7408a97d23f83a0311
|
2016-02-25 22:37:35 +01:00
|
|
|
SHA1 (patch-src_backend_Makefile) = b70b38ea23af6cdde9d2349f2441a429078cfaca
|
|
|
|
|
SHA1 (patch-src_backend_utils_adt_datetime.c) = d1ea70986634d3bfb663eff789425252656e1289
|
2016-05-23 16:27:34 +02:00
|
|
|
SHA1 (patch-src_interfaces_ecpg_pgtypeslib_interval.c) = a15012ae34d4ecd1eb2bc29e4d2c40098ea236fd
|
2016-02-25 22:37:35 +01:00
|
|
|
SHA1 (patch-src_interfaces_libpq_Makefile) = 61bcf84eb69b6ec9faabab0b61913766f4b20f8c
|
|
|
|
|
SHA1 (patch-src_makefiles_Makefile.solaris) = 0168f5bc105ffc89d5db40907a08966d8465f5a0
|
|
|
|
|
SHA1 (patch-src_pl_plperl_GNUmakefile) = 6ee3e431f46ce5c2a94df499504b2b8bd458bbef
|
postgresql: updated to 10.2, 9.6.7, 9.5.11, 9.4.16, and 9.3.21
This release fixes two security issues. This release also fixes issues with VACUUM, GIN indexes, and hash indexes that could lead to data corruption, as well as fixes for using parallel queries and logical replication.
Security Issues
* CVE-2018-1052: Fix the processing of partition keys containing multiple expressions
* CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable
Bug Fixes and Improvements
* Fix crash and potential disclosure of backend memory when processing partition keys containing multiple expressions
* Fix potential disclosure of temporary files containing database passwords created by pg_upgrade by not allowing these files to be world-accessible
* Fix cases where VACUUM would not remove dead rows if they were updated while "key-share" locked, leading to potential data corruption
* Fix for GIN indexes to prevent bloat by ensuring the pending-insertions list is cleaned up by VACUUM
* Fix potential index corruption with hash indexes due to failure to mark metapages as dirty
* Fix several potential crash scenarios for parallel queries, including when a bitmap heap scan cannot allocate memory
* Fix several potential hang-ups in parallel queries, including when a parallel worker fails to start
* Fix collection of EXPLAIN statistics from parallel workers
* Prevent fake deadlock failures when multiple sessions are running CREATE INDEX CONCURRENTLY
* Fix for trigger behavior when using logical replication
* Several fixes for "walsender" functionality to improve stability as well as visibility into the replication process
* Fix logical decoding to correctly clean up disk files for crashed transactions
* Several fixes for identity columns, including disallowing identity columns on tables derived from composite types and partitions
* Fix handling of list partitioning constraints for partition keys of boolean and array types
* Fix incorrectly generated plans for UPDATE and DELETE queries when a table has a mix of inherited regular and foreign child tables
* Fix incorrect query results from cases involving GROUPING SETS when used with flattened subqueries
* Fix UNION/INTERSECT/EXCEPT over zero columns, e.g. "SELECT UNION SELECT;"
* Several fixes for subqueries within a LATERAL subquery
* Several improvements for query planning estimation
* Allow a client that supports SCRAM channel binding, such as a future version of PostgreSQL or libpq, to connect to a PostgreSQL 10 server
* Fix sample INSTR() functions used to help transition from Oracle(r) PL/SQL to PostgreSQL PL/pgSQL to correctly match Oracle functional behavior
* Fix pg_dump to make permissions (ACL), security label, and comment entries reliably identifiable in archive outputs
* Modify behavior for contrib/cube's "cube ~> int" operator to make it compatible with KNN search. This is a backwards incompatible change and any expression indexes or materialized views using this operator will need to be reindexed and refreshed, respectively.
* Several fixes in contrib/postgres_fdw to prevent query planner errors
* Added modern examples of auto-start scripts for PostgreSQL on macOS in the contrib/start-scripts/macos directory
* Several fixes for Windows, including postmaster startup and compatibility with libperl
* Spinlock fixes and support for Motorola 68K and 88K architectures
2018-02-08 21:53:56 +01:00
|
|
|
SHA1 (patch-src_pl_plperl_plperl.h) = d31b24a953861703fe4b87d9a7d38d3c90e0411e
|
