New upstream microreleases 9.3.24, 9.5.14, and 10.5

Bug #1786938 reported by Christian Ehrhardt 
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
postgresql-10 (Ubuntu)
Fix Released
Undecided
Unassigned
Bionic
Fix Released
Undecided
Unassigned
Cosmic
Fix Released
Undecided
Unassigned
postgresql-9.3 (Ubuntu)
Invalid
Undecided
Unassigned
Trusty
Fix Released
Undecided
Unassigned
postgresql-9.5 (Ubuntu)
Invalid
Undecided
Unassigned
Xenial
Fix Released
Undecided
Unassigned

Bug Description

Postgresql stable update

Current versions in supported releases:
 postgresql-9.3 | 9.3.23-0ubuntu0.14.04 trusty
 postgresql-9.5 | 9.5.13-0ubuntu0.16.04 xenial
 postgresql-10 | 10.4-0ubuntu0.18.04 bionic
 postgresql-10 | 10.5-1 cosmic

Special cases:
- Cosmic is already synced from Debians upload
- This is again a security update, so we prep and security will eval and publish through -security

Last related stable updates: 9.3.24, 9.5.14444, 10.5

So the todo is to pick:
MRE: Trusty 9.3.24 from https://ftp.postgresql.org/pub/source/v9.3.24/postgresql-9.3.24.tar.gz
MRE: Xenial 9.5.14 from https://ftp.postgresql.org/pub/source/v9.5.14/postgresql-9.5.14.tar.gz
MRE: Bionic 10.5 from https://ftp.postgresql.org/pub/source/v10.5/postgresql-10.5.tar.gz

Standing MRE - Consider last updates as template:
- pad.lv/1637236
- pad.lv/1664478
- pad.lv/1690730
- pad.lv/1713979
- pad.lv/1730661
- pad.lv/1747676
- pad.lv/1752271
New - this bug

Related branches

CVE References

Changed in postgresql-10 (Ubuntu):
status: New → Triaged
no longer affects: postgresql-10 (Ubuntu Xenial)
no longer affects: postgresql-10 (Ubuntu Trusty)
no longer affects: postgresql-9.3 (Ubuntu Xenial)
no longer affects: postgresql-9.3 (Ubuntu Bionic)
no longer affects: postgresql-9.5 (Ubuntu Trusty)
no longer affects: postgresql-9.5 (Ubuntu Bionic)
no longer affects: postgresql-9.3 (Ubuntu Cosmic)
no longer affects: postgresql-9.5 (Ubuntu Cosmic)
Changed in postgresql-9.5 (Ubuntu Xenial):
status: New → Triaged
Changed in postgresql-9.5 (Ubuntu):
status: New → Invalid
Changed in postgresql-9.3 (Ubuntu Trusty):
status: New → Triaged
Changed in postgresql-9.3 (Ubuntu):
status: New → Invalid
Changed in postgresql-10 (Ubuntu Bionic):
status: New → Triaged
Changed in postgresql-10 (Ubuntu Cosmic):
status: Triaged → Fix Released
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Automated Bileto driven dep8 tests showed:
- Bionic - https://bileto.ubuntu.com/excuses/3354/bionic.html
  - all good
- Xenial - https://bileto.ubuntu.com/excuses/3357/xenial.html
  - almost all are already force-badtest in britney
  - one (gearmand) is a flaky test on arm it seems (test history)
  - all others good
- Trusty
  - postgresql-9.3 is already force-badtest on arm
  - libreoffice: missing ant-apache-regexp isn't postgres doing
  - pgpool2: the messages about missing tables are a red herring, it is actually "Error: Could
    not find or load main class RunTest" using the same java 7u181-2.6.14-0ubuntu0.2.
    I ran the same locally and it works right away. Maybe some java'esqe things became internet
    dependent? Again most unlikely the doing of postgresql upload.
    => http://paste.ubuntu.com/p/KsMYmdNdtj/

The PPA for the tests is at: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3354

Overall while the pgpool2 situation is not perfect it seems ok overall.

The merge proposals are linked from the bug and need a check if there is anything one would object or missing.
Waiting for an ack on them, then I think this can be uploaded.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-9.3 - 9.3.24-0ubuntu0.14.04

---------------
postgresql-9.3 (9.3.24-0ubuntu0.14.04) trusty-security; urgency=medium

  * New upstream release (LP: #1786938)
    - Fix failure to reset libpq's state fully between connection attempts
      .
      An unprivileged user of dblink or postgres_fdw could bypass the checks
      intended to prevent use of server-side credentials, such as a ~/.pgpass
      file owned by the operating-system user running the server. Servers
      allowing peer authentication on local connections are particularly
      vulnerable. Other attacks such as SQL injection into a postgres_fdw
      session are also possible. Attacking postgres_fdw in this way requires
      the ability to create a foreign server object with selected connection
      parameters, but any user with access to dblink could exploit the
      problem. In general, an attacker with the ability to select the
      connection parameters for a libpq-using application could cause
      mischief, though other plausible attack scenarios are harder to think
      of. Our thanks to Andrew Krasichkov for reporting this issue.
      (CVE-2018-10915)
    - d/libecpg-dev.install: Add new pgtypes header.
    - d/libpgtypes3.symbols: Add new pgtypes symbol.
    - Details about these and other changes can be found at
      https://www.postgresql.org/docs/9.3/static/release-9-3-24.html

 -- Christian Ehrhardt <email address hidden> Tue, 14 Aug 2018 14:49:12 +0200

Changed in postgresql-9.3 (Ubuntu Trusty):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-9.5 - 9.5.14-0ubuntu0.16.04

---------------
postgresql-9.5 (9.5.14-0ubuntu0.16.04) xenial-security; urgency=medium

  * New upstream release (LP: #1786938)
    - Fix failure to reset libpq's state fully between connection attempts
      .
      An unprivileged user of dblink or postgres_fdw could bypass the checks
      intended to prevent use of server-side credentials, such as a ~/.pgpass
      file owned by the operating-system user running the server. Servers
      allowing peer authentication on local connections are particularly
      vulnerable. Other attacks such as SQL injection into a postgres_fdw
      session are also possible. Attacking postgres_fdw in this way requires
      the ability to create a foreign server object with selected connection
      parameters, but any user with access to dblink could exploit the
      problem. In general, an attacker with the ability to select the
      connection parameters for a libpq-using application could cause
      mischief, though other plausible attack scenarios are harder to think
      of. Our thanks to Andrew Krasichkov for reporting this issue.
      (CVE-2018-10915)
    - Fix INSERT ... ON CONFLICT UPDATE through a view that isn't just SELECT
      FROM ...
      .
      Erroneous expansion of an updatable view could lead to crashes or
      attribute ... has the wrong type errors, if the view's SELECT list
      doesn't match one-to-one with the underlying table's columns.
      Furthermore, this bug could be leveraged to allow updates of columns
      that an attacking user lacks UPDATE privilege for, if that user has
      INSERT and UPDATE privileges for some other column(s) of the table. Any
      user could also use it for disclosure of server memory.
      (CVE-2018-10925)
    - d/libecpg-dev.install: Add new pgtypes header.
    - d/libpgtypes3.symbols: Add new pgtypes symbol.
    - Details about these and changes can be found at
      https://www.postgresql.org/docs/9.5/static/release-9-5-14.html

 -- Christian Ehrhardt <email address hidden> Tue, 14 Aug 2018 14:49:16 +0200

Changed in postgresql-9.5 (Ubuntu Xenial):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-10 - 10.5-0ubuntu0.18.04

---------------
postgresql-10 (10.5-0ubuntu0.18.04) bionic-security; urgency=medium

  * New upstream release (LP: #1786938)
    - Fix failure to reset libpq's state fully between connection attempts
      .
      An unprivileged user of dblink or postgres_fdw could bypass the checks
      intended to prevent use of server-side credentials, such as a ~/.pgpass
      file owned by the operating-system user running the server. Servers
      allowing peer authentication on local connections are particularly
      vulnerable. Other attacks such as SQL injection into a postgres_fdw
      session are also possible. Attacking postgres_fdw in this way requires
      the ability to create a foreign server object with selected connection
      parameters, but any user with access to dblink could exploit the
      problem. In general, an attacker with the ability to select the
      connection parameters for a libpq-using application could cause
      mischief, though other plausible attack scenarios are harder to think
      of. Our thanks to Andrew Krasichkov for reporting this issue.
      (CVE-2018-10915)
    - Fix INSERT ... ON CONFLICT UPDATE through a view that isn't just SELECT
      FROM ...
      .
      Erroneous expansion of an updatable view could lead to crashes or
      attribute ... has the wrong type errors, if the view's SELECT list
      doesn't match one-to-one with the underlying table's columns.
      Furthermore, this bug could be leveraged to allow updates of columns
      that an attacking user lacks UPDATE privilege for, if that user has
      INSERT and UPDATE privileges for some other column(s) of the table. Any
      user could also use it for disclosure of server memory.
      (CVE-2018-10925)
    - d/libecpg-dev.install: Add new pgtypes header.
    - d/libpgtypes3.symbols: Add new pgtypes symbol.
    - d/p/filter-debug-prefix-map: update to match 10.5
    - update maintainers
    - Details about these and other changes can be found at
      https://www.postgresql.org/docs/10/static/release-10-5.html

 -- Christian Ehrhardt <email address hidden> Tue, 14 Aug 2018 14:49:18 +0200

Changed in postgresql-10 (Ubuntu Bionic):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.