kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/databases/postgresql11/Makefile.common
adam cbe1d0d39e postgresql: updated to 12.4, 11.9, 10.14, 9.6.19, 9.5.23 
PostgreSQL 12.4, 11.9, 10.14, 9.6.19, 9.5.23

Security Issues

CVE-2020-14349: Uncontrolled search path element in logical replication.
Versions Affected: 10 - 12.

The PostgreSQL search_path setting determines schemas searched for tables, functions, operators, etc. The CVE-2018-1058 fix caused most PostgreSQL-provided client applications to sanitize search_path, but logical replication continued to leave search_path unchanged. Users of a replication publisher or subscriber database can create objects in the public schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser. Installations having adopted a documented secure schema usage pattern are not vulnerable.

The PostgreSQL project thanks Noah Misch for reporting this problem.

CVE-2020-14350: Uncontrolled search path element in CREATE EXTENSION.
Versions Affected: 9.5 - 12. The security team typically does not test unsupported versions, but this problem is quite old.

When a superuser runs certain CREATE EXTENSION statements, users may be able to execute arbitrary SQL functions under the identity of that superuser. The attacker must have permission to create objects in the new extension's schema or a schema of a prerequisite extension. Not all extensions are vulnerable.

In addition to correcting the extensions provided with PostgreSQL, the PostgreSQL Global Development Group is issuing guidance for third-party extension authors to secure their own work.

Bug Fixes and Improvements

This update also fixes over 50 bugs that were reported in the last several months. Some of these issues affect only version 12, but many affect all supported versions.

Some of these fixes include:

Fix edge cases in partition pruning involving multiple partition key columns with multiple or no constraining WHERE clauses.
Several fixes for query planning and execution involving partitions.
Fix for determining when to execute a column-specific UPDATE trigger on a logical replication subscriber.
pg_replication_slot_advance() now updates the oldest xmin and LSN values, as the failure to do this could prevent resources (e.g. WAL files) from being cleaned up.
Fix a performance regression in ts_headline().
Ensure that pg_read_file() and related functions read until EOF is reached, which fixes compatibility with pipes and other virtual files.
Forbid numeric NaN values in jsonpath computations, which do not exist in SQL nor JSON.
Several fixes for NaN inputs with aggregate functions. This fixes a change in PostgreSQL 12 where NaN values caused the following aggregates to emit values of 0 instead of NaN: corr(), covar_pop(), regr_intercept(), regr_r2(), regr_slope(), regr_sxx(), regr_sxy(), regr_syy(), stddev_pop(), and var_pop().
time and timetz values fractionally greater than 24:00:00 are now rejected.
Several fixes for EXPLAIN, including a fix for reporting resource usage when a plan uses parallel workers with "Gather Merge" nodes.
Fix timing of constraint revalidation in ALTER TABLE that could lead to odd errors.
Fix for REINDEX CONCURRENTLY that could prevent old values from being included in future logical decoding output.
Fix for LATERAL references that could potentially cause crashes during query execution.
Use the collation specified for a query when estimating operator costs
Fix conflict-checking anomalies in SERIALIZABLE transaction isolation mode.
Ensure checkpointer process discards file sync requests when fsync is off
Fix issue where pg_control could be written out with an inconsistent checksum, which could lead to the inability to restart the database if it crashed before the next pg_control update.
Ensure that libpq continues to try to read from the database connection socket after a write failure, as this allows the connection to collect any final error messages from the server.
Report out-of-disk-space errors properly in pg_dump and pg_basebackup
Several fixes for pg_restore, including a fix for parallel restore on tables that have both table-level and column-level privileges.
Fix for pg_upgrade to ensure it runs with vacuum_defer_cleanup_age set to 0.
Fix how pg_rewind handles just-deleted files in the source data directory
Fix failure to initialize local state correctly in contrib/dblink, which could lead to dblink_close() issuing an unexpected COMMIT on the remote server.
Change contrib/amcheck to not report about deleted index pages that are empty, as this is normal during WAL replay.
2020-08-14 06:56:22 +00:00

136 lines
4.6 KiB
Text
Raw Blame History

# $NetBSD: Makefile.common,v 1.15 2020/08/14 06:56:23 adam Exp $
#
# This Makefile fragment is included by all PostgreSQL packages built from
# the main sources of the PostgreSQL distribution except jdbc-postgresql.
#
# The PostgreSQL package naming scheme, aside from the obvious piecewise
# packages, is as follows:
# <lang>-postgresql client-side interface to PostgreSQL
# postgresql-<lang> server-side module for PostgreSQL backend
#
# used by databases/postgresql11-client/Makefile
# used by databases/postgresql11-contrib/Makefile
# used by databases/postgresql11-docs/Makefile
# used by databases/postgresql11-plperl/Makefile
# used by databases/postgresql11-plpython/Makefile
# used by databases/postgresql11-pltcl/Makefile
# used by databases/postgresql11-server/Makefile
DISTNAME= postgresql-11.9
CATEGORIES= databases
MASTER_SITES= ${MASTER_SITE_PGSQL:=source/v${PKGVERSION_NOREV}/}
EXTRACT_SUFX= .tar.bz2
MAINTAINER?= adam@NetBSD.org
HOMEPAGE= https://www.postgresql.org/
LICENSE= postgresql-license
CONFLICTS+= postgresql-[0-9]*
CONFLICTS+= postgresql[2-9][0-9]-[0-9]*
.if !empty(PKGNAME:M*-*-*)
module= ${PKGNAME:C/-[0-9].*$//:C/^.*-//}
CONFLICTS+= postgresql[2-9][0-9]-${module}-[0-9]*
.endif
DISTINFO_FILE?= ${.CURDIR}/../../databases/postgresql11/distinfo
COMMON_FILESDIR?= ${.CURDIR}/../../databases/postgresql11/files
PATCHDIR?= ${.CURDIR}/../../databases/postgresql11/patches
USE_TOOLS+= bison gmake lex
PKG_SYSCONFSUBDIR= postgresql
.include "../../mk/bsd.prefs.mk"
PG_TEMPLATE.SunOS= solaris
PG_TEMPLATE.IRIX= irix5
PG_TEMPLATE.MirBSD= openbsd
PG_TEMPLATE.DragonFly= freebsd
.if !defined(PG_TEMPLATE.${OPSYS})
PG_TEMPLATE.${OPSYS}= ${LOWER_OPSYS}
.endif
PG_DATA_DIR= ${PREFIX}/share/postgresql
PG_DOC_DIR= ${PREFIX}/share/doc/postgresql
PG_LOCALE_DIR= ${PREFIX}/${PKGLOCALEDIR}/locale
PG_ETC_DIR= ${PKG_SYSCONFDIR}
GNU_CONFIGURE= yes
CONFIGURE_ARGS+= --sysconfdir=${PG_ETC_DIR}
CONFIGURE_ARGS+= --datadir=${PG_DATA_DIR}
CONFIGURE_ARGS+= --docdir=${PG_DOC_DIR}
CONFIGURE_ARGS+= --localedir=${PG_LOCALE_DIR}
CONFIGURE_ARGS+= --with-template=${PG_TEMPLATE.${OPSYS}}
CONFIGURE_ARGS+= --with-libxml
CONFIGURE_ARGS+= --with-readline
CONFIGURE_ARGS+= --without-perl
CONFIGURE_ARGS+= --without-python
CONFIGURE_ARGS+= --without-tcl
# avoid pointing to a wrapper
CONFIGURE_ENV+= MSGFMT=${TOOLS_PATH.msgfmt}
# sys/ucred.h shouldn't be included on Solaris, causes conflicts between
# procfs and largefile.
CONFIGURE_ENV.SunOS+= ac_cv_header_sys_ucred_h=no
# pkgsrc silently filters the --as-needed linker arg, but that makes
# it leak into the pgxs Makefiles and compromises manual building
# against PostgreSQL files installed. Disable it here to prevent
# that from happening.
.if ${OPSYS} == "SunOS" || ${OPSYS} == "Darwin"
CONFIGURE_ENV+= pgac_cv_prog_cc_ldflags__Wl___as_needed=no
.endif
# configure fails on OpenBSD and MirBSD if thread safety is enabled.
CONFIGURE_ARGS.MirBSD+= --disable-thread-safety
CONFIGURE_ARGS.OpenBSD+= --disable-thread-safety
# PGSQL_BLCKSZ is the size in bytes of a PostgreSQL disk page or block.
# This also limits the size of a tuple. The valid values are powers
# of 2 up to 32768, and the default size is 8196. Please don't change
# this value unless you know what you are doing.
BUILD_DEFS+= PGSQL_BLCKSZ
.if defined(PGSQL_BLCKSZ)
CONFIGURE_ARGS+= --with-blocksize=${PGSQL_BLCKSZ}
.endif
# PostgreSQL explicitly forbids any use of -ffast-math
BUILDLINK_TRANSFORM+= rm:-ffast-math
# USE_LIBLTDL is "yes" or "no" depending on whether we're using libltdl
# to provide "dlopen" functionality for the PostgreSQL backend.
.if ${OPSYS} == "Interix"
USE_LIBLTDL?= yes
.endif
USE_LIBLTDL?= no
.include "../../devel/zlib/buildlink3.mk"
.include "../../textproc/libxml2/buildlink3.mk"
.include "../../mk/readline.buildlink3.mk"
.if ${READLINE_TYPE} == "editline"
CONFIGURE_ARGS+= --with-libedit-preferred
.endif
.if !defined(META_PACKAGE)
post-extract:
. if !empty(USE_LIBLTDL:M[yY][eE][sS])
${CP} -f ${COMMON_FILESDIR}/dynloader-ltdl.h \
${WRKSRC}/src/backend/port/dynloader/${PG_TEMPLATE.${OPSYS}:Q}.h
${ECHO} "static int dummy = 0;" \
> ${WRKSRC}/src/backend/port/dynloader/${PG_TEMPLATE.${OPSYS}:Q}.c
. endif
${TOUCH} ${WRKSRC}/src/template/dragonfly
${CP} ${WRKSRC}/src/backend/port/dynloader/freebsd.c \
${WRKSRC}/src/backend/port/dynloader/dragonfly.c
${CP} ${WRKSRC}/src/backend/port/dynloader/freebsd.h \
${WRKSRC}/src/backend/port/dynloader/dragonfly.h
${CP} ${WRKSRC}/src/include/port/freebsd.h \
${WRKSRC}/src/include/port/dragonfly.h
${CP} ${WRKSRC}/src/makefiles/Makefile.freebsd \
${WRKSRC}/src/makefiles/Makefile.dragonfly
.endif
.include "../../databases/postgresql11/options.mk"
Reference in a new issue View git blame Copy permalink