Among the 15 debian patches available in version 17.3-3 of the package, we noticed the following issues:
There is 1 open security issue in trixie.
commit 7673cf418e2a499b38772ad6a7e4517374e62576 Author: Christoph Berg <myon@debian.org> Date: Tue Feb 18 22:08:57 2025 +0100 Build-depend on openssl. (Closes: #1096243) commit 07f97b7a524626d9e0bc4756188ddd884cbc10e4 Author: Christoph Berg <myon@debian.org> Date: Tue Feb 18 12:02:19 2025 +0100 New upstream version 17.4. + Improve behavior of libpq's quoting functions (Andres Freund, Tom Lane) The changes made for CVE-2025-1094 had one serious oversight: PQescapeLiteral() and PQescapeIdentifier() failed to honor their string length parameter, instead always reading to the input string's trailing null. This resulted in including unwanted text in the output, if the caller intended to truncate the string via the length parameter. With very bad luck it could cause a crash due to reading off the end of memory. In addition, modify all these quoting functions so that when invalid encoding is detected, an invalid sequence is substituted for just the first byte of the presumed character, not all of it. This reduces the risk of problems if a calling application performs additional processing on the quoted string.