Format: 1.8 Date: Wed, 22 Nov 2023 22:07:12 -0500 Source: postgresql-14 Built-For-Profiles: noudeb Architecture: source Version: 14.10-0ubuntu0.22.04.1~ppa3 Distribution: jammy Urgency: medium Maintainer: Ubuntu Developers Changed-By: Sergio Durigan Junior Launchpad-Bugs-Fixed: 2040469 Changes: postgresql-14 (14.10-0ubuntu0.22.04.1~ppa3) jammy; urgency=medium . * New upstream version (LP: #2040469). . + A dump/restore is not required for those running 14.X. . + However, several mistakes have been discovered that could lead to certain types of indexes yielding wrong search results or being unnecessarily inefficient. It is advisable to REINDEX potentially-affected indexes after installing this update. . + Also, if you are upgrading from a version earlier than 14.9, see those release notes as well please. . + Fix handling of unknown-type arguments in DISTINCT "any" aggregate functions (Tom Lane) . This error led to a text-type value being interpreted as an unknown-type value (that is, a zero-terminated string) at runtime. This could result in disclosure of server memory following the text value. (CVE-2023-5868) . + Detect integer overflow while computing new array dimensions (Tom Lane) . When assigning new elements to array subscripts that are outside the current array bounds, an undetected integer overflow could occur in edge cases. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory. (CVE-2023-5869) . + Prevent the pg_signal_backend role from signalling background workers and autovacuum processes (Noah Misch, Jelte Fennema-Nio) . The documentation says that pg_signal_backend cannot issue signals to superuser-owned processes. It was able to signal these background processes, though, because they advertise a role OID of zero. Treat that as indicating superuser ownership. The security implications of cancelling one of these process types are fairly small so far as the core code goes (we'll just start another one), but extensions might add background workers that are more vulnerable. . Also ensure that the is_superuser parameter is set correctly in such processes. No specific security consequences are known for that oversight, but it might be significant for some extensions. (CVE-2023-5870) . + Fix misbehavior during recursive page split in GiST index build (Heikki Linnakangas) . Fix a case where the location of a page downlink was incorrectly tracked, and introduce some logic to allow recovering from such situations rather than silently doing the wrong thing. This error could result in incorrect answers from subsequent index searches. It may be advisable to reindex all GiST indexes after installing this update. . + Prevent de-duplication of btree index entries for interval columns (Noah Misch) . There are interval values that are distinguishable but compare equal, for example "24:00:00" and "1 day". This breaks assumptions made by btree de-duplication, so interval columns need to be excluded from de-duplication. This oversight can cause incorrect results from index-only scans. Moreover, after updating amcheck will report an error for almost all such indexes. Users should reindex any btree indexes on interval columns. . + Process date values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra) . The distance calculation for dates was backward, causing poor decisions about which entries to merge. The index still produces correct results, but is much less efficient than it should be. Reindexing BRIN minmax_multi indexes on date columns is advisable. . + Process large timestamp and timestamptz values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra) . Infinities were mistakenly treated as having distance zero rather than a large distance from other values, causing poor decisions about which entries to merge. Also, finite-but-very-large values (near the endpoints of the representable timestamp range) could result in internal overflows, again causing poor decisions. The index still produces correct results, but is much less efficient than it should be. Reindexing BRIN minmax_multi indexes on timestamp and timestamptz columns is advisable if the column contains, or has contained, infinities or large finite values. . + Details about these and many further changes can be found at: https://www.postgresql.org/docs/14/release-14-10.html . * d/p/libpgport-pkglibdir: Adjust patch to reflect upstream changes. . [ Christoph Berg ] * d/p/50-per-version-dirs.patch: Restore relocatability of pg_config. Checksums-Sha1: 1df897757b5f926f1730c025a36dd41194cc00a9 3884 postgresql-14_14.10-0ubuntu0.22.04.1~ppa3.dsc e3efe6ad33732431f2b2146e95a0720a794f6046 29190254 postgresql-14_14.10.orig.tar.gz f966958df8ef86106744f92e3f53284c6a62d6d1 27008 postgresql-14_14.10-0ubuntu0.22.04.1~ppa3.debian.tar.xz ef7cef8cd4a53783669cfd38e06a91ce22a889d8 8881 postgresql-14_14.10-0ubuntu0.22.04.1~ppa3_source.buildinfo Checksums-Sha256: df991ad6cfa4b26938411b1db5e9f7e718cdd87d7105fb78d90ef0a553448484 3884 postgresql-14_14.10-0ubuntu0.22.04.1~ppa3.dsc ce197c3bada3f10120f617766d9caccee6453a568122e6db52d961c749732f37 29190254 postgresql-14_14.10.orig.tar.gz 1646a04276b6cdba9eeba4fc35de4c949ebc17420d171c5ca0b9c1fa1f43efe0 27008 postgresql-14_14.10-0ubuntu0.22.04.1~ppa3.debian.tar.xz 9676ca333ce35af813e2957a31d5e2371232ac872e8b90cdf14040840b4d87f4 8881 postgresql-14_14.10-0ubuntu0.22.04.1~ppa3_source.buildinfo Files: 27e9c0f937a35fb9eb62145292157032 3884 database optional postgresql-14_14.10-0ubuntu0.22.04.1~ppa3.dsc 8d766cff942d5ca782ef4ef2541b2469 29190254 database optional postgresql-14_14.10.orig.tar.gz f4eca7348c929bae4b75dc7d4572284b 27008 database optional postgresql-14_14.10-0ubuntu0.22.04.1~ppa3.debian.tar.xz dc484d406d114af136fb0842836f6707 8881 database optional postgresql-14_14.10-0ubuntu0.22.04.1~ppa3_source.buildinfo Original-Maintainer: Debian PostgreSQL Maintainers