-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Tue, 10 Nov 2020 13:45:55 +0100 Source: postgresql-13 Architecture: source Version: 13.1-1 Distribution: unstable Urgency: medium Maintainer: Debian PostgreSQL Maintainers <team+postgresql@tracker.debian.org> Changed-By: Christoph Berg <myon@debian.org> Closes: 974063 Changes: postgresql-13 (13.1-1) unstable; urgency=medium . * New upstream version. + Fixes timetz regression test failures. (Closes: #974063) . + Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries (Noah Misch) . This is essentially a leak in the security restricted operation sandbox mechanism. An attacker having permission to create non-temporary SQL objects could parlay this leak to execute arbitrary SQL code as a superuser. . The PostgreSQL Project thanks Etienne Stalmans for reporting this problem. (CVE-2020-25695) . + Fix usage of complex connection-string parameters in pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb (Tom Lane) . The -d parameter of pg_dump and pg_restore, or the --maintenance-db parameter of the other programs mentioned, can be a connection string containing multiple connection parameters rather than just a database name. In cases where these programs need to initiate additional connections, such as parallel processing or processing of multiple databases, the connection string was forgotten and just the basic connection parameters (database name, host, port, and username) were used for the additional connections. This could lead to connection failures if the connection string included any other essential information, such as non-default SSL or GSS parameters. Worse, the connection might succeed but not be encrypted as intended, or be vulnerable to man-in-the-middle attacks that the intended connection parameters would have prevented. (CVE-2020-25694) . + When psql's \connect command re-uses connection parameters, ensure that all non-overridden parameters from a previous connection string are re-used (Tom Lane) . This avoids cases where reconnection might fail due to omission of relevant parameters, such as non-default SSL or GSS options. Worse, the reconnection might succeed but not be encrypted as intended, or be vulnerable to man-in-the-middle attacks that the intended connection parameters would have prevented. This is largely the same problem as just cited for pg_dump et al, although psql's behavior is more complex since the user may intentionally override some connection parameters. (CVE-2020-25694) . + Prevent psql's \gset command from modifying specially-treated variables (Noah Misch) . \gset without a prefix would overwrite whatever variables the server told it to. Thus, a compromised server could set specially-treated variables such as PROMPT1, giving the ability to execute arbitrary shell code in the user's session. . The PostgreSQL Project thanks Nick Cleaton for reporting this problem. (CVE-2020-25696) . * Show only log files on failure. Checksums-Sha1: ea0e5eb60884b345d1629b55a6af2464086fa4a7 3622 postgresql-13_13.1-1.dsc 3760c704f4d195100a28a983c0bc5331076259ee 21034192 postgresql-13_13.1.orig.tar.bz2 35e79666e580d59ede3583ca2f9a7e91ef99fbd8 26128 postgresql-13_13.1-1.debian.tar.xz Checksums-Sha256: 79c94566c09b7bc8ca47ac69ff93c80eb1d8d32488c5abf6cd01361a4e5716a0 3622 postgresql-13_13.1-1.dsc 12345c83b89aa29808568977f5200d6da00f88a035517f925293355432ffe61f 21034192 postgresql-13_13.1.orig.tar.bz2 35871a63aea15adea96efa10def456c8cdc5461d30f80492761c6ca904c9c90c 26128 postgresql-13_13.1-1.debian.tar.xz Files: a27b0445ecfd82ca118974fbe997eda2 3622 database optional postgresql-13_13.1-1.dsc d843a4fcc0ed1493511028aa6c17117a 21034192 database optional postgresql-13_13.1.orig.tar.bz2 f35665cf5df46a80f2ec38873932cb92 26128 database optional postgresql-13_13.1-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAl+s6ZkACgkQTFprqxLS p67m0BAAiTMuGR/7SUriMnlYFZLDfbjfvQRIzLSETdJDnwMoqvaE9pMaNTULbeMi C52/bc0F83BKC9Ru9dGCIxpngydWXoXtGjBJg+Ts5NllAM7HEdAI907g08ZUSQml ifdf4tJTwB+HD/hPqxr0mUsfQqx/U4AH9WLYXxTZgEA2x4ZJQGzJXjLRMZ8XJd5y wMeA9Txtwcvb1lOClYcbugEhs2sMfCO24S5ohUrKJGzKWK9WZgkEE0apXW04bkel iBQH0L5WEYYVCgJrgAhAouqgua+He8ymViJxcB9VXTF9HRrPeLgt7KgMkow6LDzy d7goJOf0NIylmOfHwUgyOSA4nVlwbBIdK2DfvHLtAgaWv8Cp6lsMYrFOJidtjb5T hZJG25fxLHSK1A+Zrj1FE6GpLkEjEQjABj37gPv5D5l1oPbuH8z1PgdtzFQSvbJU oTbpYeBjQ7vphHMDK0rox+HOW7ddgi1bWJdkqejRbVGYIBlnXRZ8xM5IV+KM2ly7 ibaLeiM7k6MbpXo72fenBYAUYmAXxxKdEdC2U5LJp1UuT5GIlo/zF2DYHI8VJYcp vR/Gep1xyvOu+pRhd+wbtz161kz0AiDokQDaNLWHF8zWrWBVYmPoBAfHpij/1ws/ Hfelcnudz09tksMjvGAAiR7sq6chk3ee6TpD4LhFd+2xIh6nb3g= =ho7+ -----END PGP SIGNATURE-----
