FreeBSD ports tree https://cgit-dev.freebsd.org/ports/atom?h=release%2F13.0.0 2020-11-12T15:00:39Z 2020-11-12T15:00:39Z Palle Girgensohn girgen@FreeBSD.org 2020-11-12T15:00:39Z urn:sha1:1ae27558a84b4f2e597210ccbc8408c74b2a19fc The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 13.1, 12.5, 11.10, 10.15 and 9.6.20. This release closes three security vulnerabilities and fixes over 65 bugs reported over the last three months. Due to the nature of CVE-2020-25695, we advise you to update as soon as possible. Additionally, this is the second-to-last release of PostgreSQL 9.5. If you are running PostgreSQL 9.5 in a production environment, we suggest that you make plans to upgrade. For the full list of changes, please review the release notes. Security: CVE-2020-25695: Multiple features escape "security restricted operation" sandbox Security: CVE-2020-25694: Reconnection can downgrade connection security settings Security: CVE-2020-25696: psql's \gset allows overwriting specially treated variables 2020-11-03T00:56:26Z Jan Beich jbeich@FreeBSD.org 2020-11-03T00:56:26Z urn:sha1:6d5d6429d5880f9fdf4b4b54c0fb53e44b3927f9 Changes: http://site.icu-project.org/download/68 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/ Reported by: GitHub (watch releases) 2020-09-24T13:33:10Z Palle Girgensohn girgen@FreeBSD.org 2020-09-24T13:33:10Z urn:sha1:aa1ed0e82cb937b6b71eae980dcc2554d675facb Release notes: https://www.postgresql.org/about/news/2077/ 2020-08-13T13:45:02Z Palle Girgensohn girgen@FreeBSD.org 2020-08-13T13:45:02Z urn:sha1:c181e5cbd7b38d4c01a7bb7360c293e5cd8f2a5b supported versions of our database system, including 12.4, 11.9, 10.14, 9.6.19, and 9.5.23. This release closes two security vulnerabilities and fixes over 50 bugs reported over the last three months. Please plan to update at your earliest convenience. Security Issues --------------- * CVE-2020-14349: Uncontrolled search path element in logical replication. Versions Affected: 10 - 12. The PostgreSQL `search_path` setting determines schemas searched for tables, functions, operators, etc. The CVE-2018-1058 fix caused most PostgreSQL-provided client applications to sanitize `search_path`, but logical replication continued to leave `search_path` unchanged. Users of a replication publisher or subscriber database can create objects in the `public` schema and harness them to execute arbitrary SQL functions under the identity running replication, often a superuser. Installations having adopted a documented secure schema usage pattern are not vulnerable. The PostgreSQL project thanks Noah Misch for reporting this problem. * CVE-2020-14350: Uncontrolled search path element in `CREATE EXTENSION`. Versions Affected: 9.5 - 12. The security team typically does not test unsupported versions, but this problem is quite old. When a superuser runs certain `CREATE EXTENSION` statements, users may be able to execute arbitrary SQL functions under the identity of that superuser. The attacker must have permission to create objects in the new extension's schema or a schema of a prerequisite extension. Not all extensions are vulnerable. In addition to correcting the extensions provided with PostgreSQL, the PostgreSQL Global Development Group is issuing guidance for third-party extension authors to secure their own work. The PostgreSQL project thanks Andres Freund for reporting this problem. Security: CVE-2020-14349, CVE-2020-14350 2020-05-17T20:37:04Z Palle Girgensohn girgen@FreeBSD.org 2020-05-17T20:37:04Z urn:sha1:751aa87e6ac88bd51b95ae7f646cbe1aea156772 supported versions of our database system, including 12.3, 11.8, 10.13, 9.6.18, and 9.5.22. This release fixes one security issue found in the PostgreSQL server and over 75 bugs reported over the last three months. Please plan to update at your earliest convenience. Update the backup warning text. [1] Add plpython and plperl libs for hstore, jsonb and ltree for the versions where they exist. These libs are added to the postgresql??-plpython and -plperl ports, inspired by [2]. PR: 237910 [1], 245246 [2] Submitted by: Francesco [1], Loïc Bartoletti [2] 2020-04-23T20:14:49Z Jan Beich jbeich@FreeBSD.org 2020-04-23T20:14:49Z urn:sha1:ffb8eb82e5af66728d3fc269976d7048c733f4a2 Changes: http://site.icu-project.org/download/67 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/ Reported by: GitHub (watch releases) 2020-03-13T09:54:51Z Jan Beich jbeich@FreeBSD.org 2020-03-13T09:54:51Z urn:sha1:1ecffdfc3fffe3e97af971c61602b1451bf1b20f 2020-03-13T09:47:16Z Jan Beich jbeich@FreeBSD.org 2020-03-13T09:47:16Z urn:sha1:f821cdc3470d31fc0b70510a2f5ca7cb12d02c7b Changes: http://site.icu-project.org/download/66 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/ 2020-02-13T19:14:36Z Palle Girgensohn girgen@FreeBSD.org 2020-02-13T19:14:36Z urn:sha1:0782cccb139e9c7982cd27d695075990a46e5095 supported versions of our database system, including 12.2, 11.7, 10.12, 9.6.17, 9.5.21, and 9.4.26. This release fixes one security issue found in the PostgreSQL server and over 75 bugs reported over the last three months. Users should plan to update as soon as possible. PostgreSQL 9.4 Now EOL This is the last release for PostgreSQL 9.4, which will no longer receive security updates and bug fixes. PostgreSQL 9.4 introduced new features such as JSONB support, the `ALTER SYSTEM` command, the ability to stream logical changes to an output plugin, and more: https://www.postgresql.org/about/news/1557/ https://www.postgresql.org/docs/9.4/release-9-4.html While we are very proud of this release, these features are also found in newer versions of PostgreSQL. Many of these features have also received improvements, and, per our versioning policy, it is time to retire PostgreSQL 9.4. To receive continued support, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see the PostgreSQL versioning policy for more information. Security Issues * CVE-2020-1720: `ALTER ... DEPENDS ON EXTENSION` is missing authorization checks. Versions Affected: 9.6 - 12 The `ALTER ... DEPENDS ON EXTENSION` sub-commands do not perform authorization checks, which can allow an unprivileged user to drop any function, procedure, materialized view, index, or trigger under certain conditions. This attack is possible if an administrator has installed an extension and an unprivileged user can `CREATE`, or an extension owner either executes `DROP EXTENSION` predictably or can be convinced to execute `DROP EXTENSION`. Release notes: https://www.postgresql.org/docs/current/release.html 2019-12-30T18:04:39Z Adam Weinberger adamw@FreeBSD.org 2019-12-30T18:04:39Z urn:sha1:6eaf92cd8f518bb2f08235d80c461ae550b08f40 Avoids the libxml/libxslt2 dependency chain for systems that don't need the XML datatype plugin. PR: 239638 Approved by: maintainer timeout (pgsql team, nearly 5 months)