FreeBSD ports tree https://cgit-dev.freebsd.org/ports/atom?h=main 2018-02-10T22:14:39Z 2018-02-10T22:14:39Z Rene Ladan rene@FreeBSD.org 2018-02-10T22:14:39Z urn:sha1:e2db11150616f8dc82b930c5dc3f6ddf11bff67c 2018-02-08T17:38:36Z Palle Girgensohn girgen@FreeBSD.org 2018-02-08T17:38:36Z urn:sha1:955b7d13bc3c846c8db5252aba9551900f2bcd5a 2018-02-08 Security Update Release ================================== The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 10.2, 9.6.7, 9.5.11, 9.4.16, 9.3.21. This release fixes two security issues. This release also fixes issues with VACUUM, GIN indexes, and hash indexes that could lead to data corruption, as well as fixes for using parallel queries and logical replication. All users using the affected versions of PostgreSQL should update as soon as possible. Please see the notes on "Updating" below for any post-update steps that may be required. Please note that PostgreSQL changed its versioning scheme with the release of version 10.0, so updating to version 10.2 from 10.0 or 10.1 is considered a minor update. Security Issues --------------- Two security vulnerabilities have been fixed by this release: * CVE-2018-1052: Fix the processing of partition keys containing multiple expressions * CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable Local fixes to the FreeBSD ports -------------------------------- Inform users about data checksums [1]. Make sure /usr/bin/su is used regardless of PATH settings [2]. Enable DTRACE by default [3]. PR: 214671 [1], 223157 [2], 215028 [3] Security: c602c791-0cf4-11e8-a2ec-6cc21735f730 2017-09-05T09:27:11Z Palle Girgensohn girgen@FreeBSD.org 2017-09-05T09:27:11Z urn:sha1:548c838795dfe6d521e7c18e1b2b38133ebe0fa9 supported versions of our database system, including 9.6.5, 9.5.9, 9.4.14, 9.3.19, and 9.2.23. This release includes fixes that prevent a crash in pg_restore when using parallel mode. It also patches over a few other bugs reported since the last releases in August. Additionally, in 9.4.14 only, there is a fix to an issue with walsenders preventing primary-server shutdown unless immediate shutdown mode is used. Users should plan to update at the next convenient downtime. Bug Fixes and Improvements This update also fixes a number of bugs reported in the last few weeks. Some of these issues affect only version 9.6, but many affect all supported versions: * Show foreign tables in information_schema.table_privileges view. This fix applies to new databases, see the release notes for the procedure to apply the fix to an existing database. * Correctly identify columns that are of a range type or domain type over a composite type or domain type being searched for * Prevent crash when passing fixed-length pass-by-reference data types to parallel worker processes * Change ecpg’s parser to allow RETURNING clauses without attached C variables * Change ecpg’s parser to recognize backslash continuation of C preprocessor command lines * Improve selection of compiler flags for PL/Perl on Windows 2017-07-17T11:15:50Z Dmitry Marakasov amdmi3@FreeBSD.org 2017-07-17T11:15:50Z urn:sha1:7184f1831f4ab88354cdc15e5b17d62bcf13d663 PR: 217874 Approved by: maintainer timeout (pgsql, 4 months) 2017-06-28T14:51:22Z Sunpoet Po-Chuan Hsieh sunpoet@FreeBSD.org 2017-06-28T14:51:22Z urn:sha1:6af17fca7696d4e0e3e6b9b53a33f9257a139ec9 PR: 219947 2016-01-13T10:36:22Z Palle Girgensohn girgen@FreeBSD.org 2016-01-13T10:36:22Z urn:sha1:a9c901ec2bd7061cb5a9f38c4aa1b4608c00cf1f pg_upgrade. Other where added in 9.5, but the port failed to install them. Make sure they are properly installed by the correct port (-client or -server) [1] Remove unused and hence confusing OSSP_UUID parameters from Makefile [2] Add options to allow user to be set for the backup script in periodic. Add this option only to 9.5 for now. It will be updated to other servers at next regular patch release. [3] The path to perl in hard coded into pgxs/src/Makefile.global which is then installed. Hence, we must depend on perl when that file is installed. Noticed by: Paul Guyot [1] PR: 192387 [2] PR: 172110 [3] PR: 206046 [4] 2015-10-08T21:25:01Z Palle Girgensohn girgen@FreeBSD.org 2015-10-08T21:25:01Z urn:sha1:0642ae4b77cc7e0c9aa0ffaa0045771924380dc5 Two security issues have been fixed in this release which affect users of specific PostgreSQL features: CVE-2015-5289: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service. CVE-2015-5288: The crypt( function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed. This update will also disable SSL renegotiation by default; previously, it was enabled by default. SSL renegotiation will be removed entirely in PostgreSQL versions 9.5 and later. URL: http://www.postgresql.org/about/news/1615/ Security: CVE-2015-5288 CVE-2015-5289 2015-05-22T23:22:19Z Palle Girgensohn girgen@FreeBSD.org 2015-05-22T23:22:19Z urn:sha1:89f2bb6e59de11ab88f81b6803620c9f86d2a44f Data Corruption Fix For users of PostgreSQL versions 9.3 or 9.4, this release fixes a problem where the database will fail to protect against "multixact wraparound", resulting in data corruption or loss. Users with a high transaction rate (1 million or more per hour) in a database with many foreign keys are especially vulnerable. We strongly urge all users of 9.4 and 9.3 to update their installations in the next few days. Users of versions 9.2 and earlier are not affected by this issue. Security: fc38cd83-00b3-11e5-8ebd-0026551a22dc 2015-02-07T17:05:07Z Palle Girgensohn girgen@FreeBSD.org 2015-02-07T17:05:07Z urn:sha1:cbb709bca29aceb9ff29b8250f475ab15a0b98dd PR: ports/197362 2015-02-05T22:54:34Z Palle Girgensohn girgen@FreeBSD.org 2015-02-05T22:54:34Z urn:sha1:262af710e75062789fef1dfdcd828d76841b8ffc This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list of security holes patched below in case they are particularly vulnerable. Security: CVE-2015-0241,CVE-2015-0242,CVE-2015-0243, CVE-2015-0244,CVE-2014-8161