-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 10 Feb 2021 17:33:55 +0100 Source: postgresql-13 Architecture: source Version: 13.2-1 Distribution: unstable Urgency: medium Maintainer: Debian PostgreSQL Maintainers <team+postgresql@tracker.debian.org> Changed-By: Christoph Berg <myon@debian.org> Closes: 974988 979456 Changes: postgresql-13 (13.2-1) unstable; urgency=medium . * New upstream version. . + Fix failure to check per-column SELECT privileges in some join queries (Tom Lane) . In some cases involving joins, the parser failed to record all the columns read by a query in the column-usage bitmaps that are used for permissions checking. Although the executor would still insist on some sort of SELECT privilege to run the query, this meant that a user having SELECT privilege on only one column of a table could nonetheless read all its columns through a suitably crafted query. . A stored view that is subject to this problem will have incomplete column-usage bitmaps, and thus permissions will still not be enforced properly on the view after updating. In installations that depend on column-level permissions for security, it is recommended to CREATE OR REPLACE all user-defined views to cause them to be re-parsed. . The PostgreSQL Project thanks Sven Klemm for reporting this problem. (CVE-2021-20229) . + Fix information leakage in constraint-violation error messages (Heikki Linnakangas) . If an UPDATE command attempts to move a row to a different partition but finds that it violates some constraint on the new partition, and the columns in that partition are in different physical positions than in the parent table, the error message could reveal the contents of columns that the user does not have SELECT privilege on. (CVE-2021-3393) . + Fix incorrect detection of concurrent page splits while inserting into a GiST index (Heikki Linnakangas) . Concurrent insertions could lead to a corrupt index with entries placed in the wrong pages. It's recommended to reindex any GiST index that's been subject to concurrent insertions. . + Fix CREATE INDEX CONCURRENTLY to wait for concurrent prepared transactions (Andrey Borodin) . At the point where CREATE INDEX CONCURRENTLY waits for all concurrent transactions to complete so that it can see rows they inserted, it must also wait for all prepared transactions to complete, for the same reason. Its failure to do so meant that rows inserted by prepared transactions might be omitted from the new index, causing queries relying on the index to miss such rows. In installations that have enabled prepared transactions (max_prepared_transactions > 0), it's recommended to reindex any concurrently-built indexes in case this problem occurred when they were built. . [ Christoph Berg ] * Remove obsolete --enable-integer-datetimes configure option. (Closes: #974988) * Modernize server package description. * Use xsltproc --nonet. * run-testsuite: Test only this version. . [ Helmut Grohne ] * Reduce Build-Depends: (Closes: #979456) + gdb is only used for testing. Checksums-Sha1: a97e0dd433b14920bf66ed9f839dff9cefdd48f5 3633 postgresql-13_13.2-1.dsc fc40c06ee7f2fd5f4ee5af88c8502f06a44c8698 21057276 postgresql-13_13.2.orig.tar.bz2 98f0259f51d3da0e04d42af76c1c98253232efed 27304 postgresql-13_13.2-1.debian.tar.xz Checksums-Sha256: 87b5a1a4b184705f3d8ef6d044269a1e427329e55fdc76816c3b97a4cb4a626e 3633 postgresql-13_13.2-1.dsc 5fd7fcd08db86f5b2aed28fcfaf9ae0aca8e9428561ac547764c2a2b0f41adfc 21057276 postgresql-13_13.2.orig.tar.bz2 6429343f55d95a51232d2fab9473491735a5803086591beb3ffe0848cdfc70f5 27304 postgresql-13_13.2-1.debian.tar.xz Files: 336359d017d6752d67e4958c2d006c62 3633 database optional postgresql-13_13.2-1.dsc c7b352c2774d6c3e03bd2558c03da876 21057276 database optional postgresql-13_13.2.orig.tar.bz2 89c6af76f03e95dc2f18ba982026eabc 27304 database optional postgresql-13_13.2-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmAlCNAACgkQTFprqxLS p66Cpw/9F+s/zWoeXUZKBf+GuukCJalAPcj0A2eCDe9otqf6crRLtWLGS6EX6gFl y6xnIrrTVrt/8S5MOQ/I4WJqG1rMRcuGHl9zZPn1/Dg0b4vKrLRImTaLp/iJ5Pzp iQfFkDglMbOreGxf/Fnrn+FSY02l1eqpMbBFbzYo+vsOSwtzw6hhbC0CH4505aaZ kzd3vnI6xyjHcinxEp+KLk+g1rohZsXujvd5RcHl3/SKQ/qJ3KadUxzkbi44mmlk 9NYzXzyu5/V2sQ28jNr8rIeJqsLkdW+pXxfBY0F7dut1hnHfIM+Mz6o/rJ0X7XE7 hJmXF3VIZgEXFc/RiWRt3kSbDtzHekFEk/yKIPnERTs8dQMIokS7atEiAz+ouO7D wcJbohgSAefB03Z+eUmd2IveiqKaO9Kmy44dPEkXipxMViDUvNsLfBMWAJiU/dvW 7135iopJpRhTwAx96DhYL2cMg+kOnWIKLYp/dopPV7oSokvIQAROFSm1l3HDoHqi kEBo1A5VOH9yWRlx5mUfdNv28nimmcDHrzw+BpC3IxGwalXbWGU6Hzdclz9Ly5jG wRXCQ3XXV2XAxP3Ufwcs9iFdTm3N377F8P6ZJlVY/iQ57RV1oUp2GDZ/DUTri6B+ 4wvtiPgM7fuI013owYXb+Levds0nL98FAaZ4metYue0llXmBKFE= =llg8 -----END PGP SIGNATURE-----
