-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 01 Dec 2020 10:04:12 +0100 Source: postgresql-11 Binary: libecpg-compat3 libecpg-compat3-dbgsym libecpg-dev libecpg-dev-dbgsym libecpg6 libecpg6-dbgsym libpgtypes3 libpgtypes3-dbgsym libpq-dev libpq5 libpq5-dbgsym postgresql-11 postgresql-11-dbgsym postgresql-client-11 postgresql-client-11-dbgsym postgresql-plperl-11 postgresql-plperl-11-dbgsym postgresql-plpython-11 postgresql-plpython-11-dbgsym postgresql-plpython3-11 postgresql-plpython3-11-dbgsym postgresql-pltcl-11 postgresql-pltcl-11-dbgsym postgresql-server-dev-11 postgresql-server-dev-11-dbgsym Architecture: amd64 Version: 11.10-0+deb10u1 Distribution: buster Urgency: medium Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) Changed-By: Christoph Berg Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 11 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql-11 - object-relational SQL database, version 11 server postgresql-client-11 - front-end programs for PostgreSQL 11 postgresql-plperl-11 - PL/Perl procedural language for PostgreSQL 11 postgresql-plpython-11 - PL/Python procedural language for PostgreSQL 11 postgresql-plpython3-11 - PL/Python 3 procedural language for PostgreSQL 11 postgresql-pltcl-11 - PL/Tcl procedural language for PostgreSQL 11 postgresql-server-dev-11 - development files for PostgreSQL 11 server-side programming Closes: 974063 Changes: postgresql-11 (11.10-0+deb10u1) buster; urgency=medium . * New upstream version. + Fixes timetz regression test failures. (Closes: #974063) . + Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries (Noah Misch) . This is essentially a leak in the security restricted operation sandbox mechanism. An attacker having permission to create non-temporary SQL objects could parlay this leak to execute arbitrary SQL code as a superuser. . The PostgreSQL Project thanks Etienne Stalmans for reporting this problem. (CVE-2020-25695) . + Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb (Tom Lane) . The -d parameter of pg_dump and pg_restore, or the --maintenance-db parameter of the other programs mentioned, can be a connection string containing multiple connection parameters rather than just a database name. In cases where these programs need to initiate additional connections, such as parallel processing or processing of multiple databases, the connection string was forgotten and just the basic connection parameters (database name, host, port, and username) were used for the additional connections. This could lead to connection failures if the connection string included any other essential information, such as non-default SSL or GSS parameters. Worse, the connection might succeed but not be encrypted as intended, or be vulnerable to man-in-the-middle attacks that the intended connection parameters would have prevented. (CVE-2020-25694) . + When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used (Tom Lane) . This avoids cases where reconnection might fail due to omission of relevant parameters, such as non-default SSL or GSS options. Worse, the reconnection might succeed but not be encrypted as intended, or be vulnerable to man-in-the-middle attacks that the intended connection parameters would have prevented. This is largely the same problem as just cited for pg_dump et al, although psql's behavior is more complex since the user may intentionally override some connection parameters. (CVE-2020-25694) . + Prevent psql's \gset command from modifying specially-treated variables (Noah Misch) . \gset without a prefix would overwrite whatever variables the server told it to. Thus, a compromised server could set specially-treated variables such as PROMPT1, giving the ability to execute arbitrary shell code in the user's session. . The PostgreSQL Project thanks Nick Cleaton for reporting this problem. (CVE-2020-25696) Checksums-Sha1: 4dc4d4eb4ab235f9bb742b1c01ca1ee102021c8f 19276 libecpg-compat3-dbgsym_11.10-0+deb10u1_amd64.deb 13e4906edb558ca15ab50e7809cbe8de2bbe9d0c 18892 libecpg-compat3_11.10-0+deb10u1_amd64.deb 4621b9fcab4ab173d84935452f87686735d13eb6 218196 libecpg-dev-dbgsym_11.10-0+deb10u1_amd64.deb 0f07e63735dba15a455e620f229f1f39000a3ab7 238576 libecpg-dev_11.10-0+deb10u1_amd64.deb 5a9180d383639ffa5133ea5dc441139b80518242 111592 libecpg6-dbgsym_11.10-0+deb10u1_amd64.deb d3e1c7cf44dc9e20c034a0d492582fb6ec7672cd 87992 libecpg6_11.10-0+deb10u1_amd64.deb fc2785e2f7b170a463f75d079a0e94995d754b26 77540 libpgtypes3-dbgsym_11.10-0+deb10u1_amd64.deb 624012bf6324dd843b479bb748022eb8b9cb70ab 40948 libpgtypes3_11.10-0+deb10u1_amd64.deb bd5cf3d799445dbc638de36d7fe04bf6852f2453 163664 libpq-dev_11.10-0+deb10u1_amd64.deb 9fd8fa7feed82a6be9ed51852840b1bab4cea1e4 293784 libpq5-dbgsym_11.10-0+deb10u1_amd64.deb 26e7ea099681cc16dba6bbcdbfb9ab395943d790 168284 libpq5_11.10-0+deb10u1_amd64.deb 03960e68310cff68a9acd73c57c5fadfa6283da9 19439044 postgresql-11-dbgsym_11.10-0+deb10u1_amd64.deb 9512a99550bd6c38497fbd5e4790a7caf0016ce0 16570 postgresql-11_11.10-0+deb10u1_amd64-buildd.buildinfo 7d2d50b63d0ca81a9863404a309ea07b8585c30e 14119620 postgresql-11_11.10-0+deb10u1_amd64.deb 390030000654e36eb2d2271a72dbb7dbca92f44e 1897772 postgresql-client-11-dbgsym_11.10-0+deb10u1_amd64.deb 7fe30d1c29e390fcc5fb20ae01b50488e0b082d2 1404984 postgresql-client-11_11.10-0+deb10u1_amd64.deb b3139046ce785ad56085a3242f4395d30ff53512 247784 postgresql-plperl-11-dbgsym_11.10-0+deb10u1_amd64.deb d994df3d4fa2eddaf8d54400d558f87d8dc2c425 66644 postgresql-plperl-11_11.10-0+deb10u1_amd64.deb 61fd49c121a8f021eae09cf4c8eda8cd0b66de9c 308188 postgresql-plpython-11-dbgsym_11.10-0+deb10u1_amd64.deb d34c5b15e5cc3da64dcaf0806f38b4328c661e17 56888 postgresql-plpython-11_11.10-0+deb10u1_amd64.deb ddc11c86fc69216816bd92db6af598eda87fe868 335836 postgresql-plpython3-11-dbgsym_11.10-0+deb10u1_amd64.deb c38a85fff18e7ce7a0f2c2d1b8c8f543bcf4f964 72912 postgresql-plpython3-11_11.10-0+deb10u1_amd64.deb 27f70909de57b5228e41141112c25f63abe00132 99780 postgresql-pltcl-11-dbgsym_11.10-0+deb10u1_amd64.deb a6d46663a5bc5728ed19929fbb7fce878879ca5f 39676 postgresql-pltcl-11_11.10-0+deb10u1_amd64.deb e02692b0fbd308b846a8b400253c0536e34142f3 102128 postgresql-server-dev-11-dbgsym_11.10-0+deb10u1_amd64.deb 9347c2414319e71273f9acf94ac92861ec07856b 936632 postgresql-server-dev-11_11.10-0+deb10u1_amd64.deb Checksums-Sha256: 84283382b1e5603b9c75cb52bc8ba6155aa8e03b89cc2ae0fba9c8d9cdb4a9c2 19276 libecpg-compat3-dbgsym_11.10-0+deb10u1_amd64.deb d8aee4f51aff4ae75108fda8be2d218a7ffdf4aae629c6b680ec33caf262a69c 18892 libecpg-compat3_11.10-0+deb10u1_amd64.deb 2c6d06641d80a27d0c2d57378e9b2ce29a3f83276b338dae91d240ead52b6edb 218196 libecpg-dev-dbgsym_11.10-0+deb10u1_amd64.deb 3c2657905295a4a8b05ad57c08c67c0fdc431d802a83b22b1b9286f2730713ff 238576 libecpg-dev_11.10-0+deb10u1_amd64.deb ab5b393d0b2def96665b871bf2546bddb66ce5e9ec787c7d7c3ee7e7c8c35601 111592 libecpg6-dbgsym_11.10-0+deb10u1_amd64.deb b6dcc963c7af881e1bac8808e17625c99a6a73b57159684d0f7a31b1fe041b24 87992 libecpg6_11.10-0+deb10u1_amd64.deb 5d5606832169d704d92df4b7562ccbddc32ea5a85c0b451d429f12a863be4ff5 77540 libpgtypes3-dbgsym_11.10-0+deb10u1_amd64.deb 996b24055faebd7aa16db428479ef22b286b94e616c40c3e88d80185e48ab280 40948 libpgtypes3_11.10-0+deb10u1_amd64.deb fa974fbc80c580ada3cca1ee4efa18099734f8dbc4f7e17c3f2711b2c63434d9 163664 libpq-dev_11.10-0+deb10u1_amd64.deb bc1d01f0b215c0102534d55063bf330f391fa1333f85a5610c25d1c715f8c80b 293784 libpq5-dbgsym_11.10-0+deb10u1_amd64.deb 15c3e20c237c643e12fcbd0eb09cfe098e4fde8189ef24739797c2bc3c387d47 168284 libpq5_11.10-0+deb10u1_amd64.deb 1a8b6f6231574cd4e9bd7f4456fef44568f0f549c7134bedf4455d5f0f5b305f 19439044 postgresql-11-dbgsym_11.10-0+deb10u1_amd64.deb cc2812933394a5fab47687f8c45e5fc0b2bc43f400fdcaf6178db8f1539cecfe 16570 postgresql-11_11.10-0+deb10u1_amd64-buildd.buildinfo 761dfbaa158b6cb143f5b7cccb3df929412bfc655f713158cebe235bb46cfccc 14119620 postgresql-11_11.10-0+deb10u1_amd64.deb 5c62324649f6b4766951e0b2171fbc90cc1c6004224f18414aed17d3cf929407 1897772 postgresql-client-11-dbgsym_11.10-0+deb10u1_amd64.deb 075eec1d72b4bfafb2faab99ece9e359ffa3e4de325780d532cdbe518dcf7791 1404984 postgresql-client-11_11.10-0+deb10u1_amd64.deb 5304fc1c3c9dd61a76a45ce7075208fb7360f34d617298c597796c1e99c56a5a 247784 postgresql-plperl-11-dbgsym_11.10-0+deb10u1_amd64.deb fe01553ef5974457cb584177eacff2934f831a719e02e71d157f531f032690bc 66644 postgresql-plperl-11_11.10-0+deb10u1_amd64.deb 995e6dd6d268b15db1b16884d092b39b2cd70e6aea7eed01799de15d0922d6f9 308188 postgresql-plpython-11-dbgsym_11.10-0+deb10u1_amd64.deb 7e82fb76031e235cbab5a8f075fcd34fae370d534598a9a970d6ac0c0abe5873 56888 postgresql-plpython-11_11.10-0+deb10u1_amd64.deb 6e67bff9f377f8747ed1218fed4ac746baa831681b16e906feba8ad63ee46859 335836 postgresql-plpython3-11-dbgsym_11.10-0+deb10u1_amd64.deb 0bae28fb232e7168bf490f6fad649779411e1ff59fea90404b7e88fa5993ccd1 72912 postgresql-plpython3-11_11.10-0+deb10u1_amd64.deb b55717b7fb4bd01488313aeb329db2121292f8b479b2c76f35a3cc5552e1776b 99780 postgresql-pltcl-11-dbgsym_11.10-0+deb10u1_amd64.deb 73a4f793489be6f47fffdf5c4d6899d35b24dd533f6741c9681efee04873b822 39676 postgresql-pltcl-11_11.10-0+deb10u1_amd64.deb d82b13f0fd0d78370b8cca0a22d2379bab24e17719766b4721db54c44aaebf3b 102128 postgresql-server-dev-11-dbgsym_11.10-0+deb10u1_amd64.deb 7d41eee1cf14175c0a885a0bcd696984db26d3b894c217db1333ea436b29e423 936632 postgresql-server-dev-11_11.10-0+deb10u1_amd64.deb Files: 8e57138d216e0b83fabe193f27e75ce6 19276 debug optional libecpg-compat3-dbgsym_11.10-0+deb10u1_amd64.deb f6e67837356e7a50c4fe0b108cf4eae4 18892 libs optional libecpg-compat3_11.10-0+deb10u1_amd64.deb 9d7186f52ee3df8fadbfc68f59cab504 218196 debug optional libecpg-dev-dbgsym_11.10-0+deb10u1_amd64.deb 76b73bc3613794c899c4637f652a5700 238576 libdevel optional libecpg-dev_11.10-0+deb10u1_amd64.deb 1fa16f76c971c37f2020bfabf5bfb9c7 111592 debug optional libecpg6-dbgsym_11.10-0+deb10u1_amd64.deb f34f4559a569b40aeb76971c4ea5c31a 87992 libs optional libecpg6_11.10-0+deb10u1_amd64.deb 1be297cd3011d761f92c819082b7752a 77540 debug optional libpgtypes3-dbgsym_11.10-0+deb10u1_amd64.deb b48a1977163a2f9fb2e011282adf4f2b 40948 libs optional libpgtypes3_11.10-0+deb10u1_amd64.deb 5cc9861b12fc714a2a0b1a2b38759906 163664 libdevel optional libpq-dev_11.10-0+deb10u1_amd64.deb 6a6cf32e28620199c3b30c30d7b7cc64 293784 debug optional libpq5-dbgsym_11.10-0+deb10u1_amd64.deb d378d92c013eff803bc3cfca0fea7a0d 168284 libs optional libpq5_11.10-0+deb10u1_amd64.deb 7b159450337549b6cd0031a0c35ba057 19439044 debug optional postgresql-11-dbgsym_11.10-0+deb10u1_amd64.deb 993ed19f1784d4340dbe1974f14ead15 16570 database optional postgresql-11_11.10-0+deb10u1_amd64-buildd.buildinfo 0ee97d75467691f32422b7611909243e 14119620 database optional postgresql-11_11.10-0+deb10u1_amd64.deb be08e0ee6686c56ac30d03f35ca331cd 1897772 debug optional postgresql-client-11-dbgsym_11.10-0+deb10u1_amd64.deb 3adee840006eb7866c1706d44a3203a9 1404984 database optional postgresql-client-11_11.10-0+deb10u1_amd64.deb 1548083700080958d2de2964316957a7 247784 debug optional postgresql-plperl-11-dbgsym_11.10-0+deb10u1_amd64.deb 09f1a0c12e09cb0116f336e7a828425d 66644 database optional postgresql-plperl-11_11.10-0+deb10u1_amd64.deb 9796ce843cb9fab7a1c43f4befd2c140 308188 debug optional postgresql-plpython-11-dbgsym_11.10-0+deb10u1_amd64.deb 8af8845bca9425f0e9283abed11468b3 56888 database optional postgresql-plpython-11_11.10-0+deb10u1_amd64.deb e1948bb869e3d73cfe2b2d169ce30f85 335836 debug optional postgresql-plpython3-11-dbgsym_11.10-0+deb10u1_amd64.deb e7f157c0254de60bca444a595f9c15f3 72912 database optional postgresql-plpython3-11_11.10-0+deb10u1_amd64.deb 642c94b14a04c9c36e36a74515b2c63c 99780 debug optional postgresql-pltcl-11-dbgsym_11.10-0+deb10u1_amd64.deb 4e4ad08c9c852dbcbd84e099c4983db6 39676 database optional postgresql-pltcl-11_11.10-0+deb10u1_amd64.deb f7f4637af303e0c0c02a5528ad7ad901 102128 debug optional postgresql-server-dev-11-dbgsym_11.10-0+deb10u1_amd64.deb e6469eae703934230447c803b828c11d 936632 libdevel optional postgresql-server-dev-11_11.10-0+deb10u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEB0DaZsfXBcbc9rpNxLW3Jkp2Je4FAl/NnYgACgkQxLW3Jkp2 Je7DOw//cAlRFB2qOVlK31Q8Umwim4JhcpZEe/0GZEGmqfIQVqG+lfTSkK0P38uu EG0ZoX0MiN/Gtff8WuwS52mkFZxUY+6zPOwK+TQoP89f19SbldNBzSFG/kB/JgYf ccKStGeeXzl//7BersdFSKUiAco73W7EUQwK0gttB/OuNjgiYrCcqCNAJvZSLB+e hjMHOULxPO7exnXoWA+2kr4PaaIeGIBL4EfUu2c/3Irr11N05kTQyjNM3H87AFC8 3xUCsSL/5bXPRDDs405ssjZ8jr4pfVb/xMM1Y5aShnrin8wuN9QQ6jXOWpGy8aW2 h/mL3584eiwD19ExhHPWkKawfQ3pR6iqm+EOvcvt63I/HzPEHxh67L2xkltr3qeJ Vg8TD9GwEChCRlb4O64EjyRTbJ4IdTDStOgFZCzIjgbTSKM+cGrXyIYlsHLaj5t0 MldTzLSJb896so40m+y6rSySQyqQWo+qxIml3u1aZASOV2gS75Zgv0nufwp3GOjq q+zwXsxv1fabiudxzoa8qcFuBgjbIun1FTe4Dp8qdWfAhM2N98yvv1JxNxR6klTx GOjbLMOa288C60kSSMNc9DbffiY/SgkryHbbPAusW3NxdvSgp8N03WnMSHiW4Qe3 bnbWJ54ldlhb+SfYtTIWsoSHZ0tjmNTq76vcBh2TEU9wRS0Wr8o= =1lsG -----END PGP SIGNATURE-----