HomeFreeBSD

databases/postgresql??-server: update to latest version

Description

databases/postgresql??-server: update to latest version

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 14.3, 13.7, 12.11, 11.16,
and 10.21. This release fixes over 50 bugs reported over the last three
months. This release closes one security vulnerability and fixes over 50
bugs reported over the last three months.

We encourage you to install this update at your earliest possible
convenience.

If you have any GiST indexes on columns using the ltree data type, you
will need to reindex them after upgrading.

For the full list of changes, please review the release notes.

It also fixes a security issue, CVE-2022-1552:

Autovacuum, REINDEX, and others omit "security restricted operation" sandbox.

Versions Affected: 10 - 14. The security team typically does not test
unsupported versions, but this problem is quite old.

Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER,
and pg_amcheck made incomplete efforts to operate safely when a
privileged user is maintaining another user's objects. Those commands
activated relevant protections too late or not at all. An attacker
having permission to create non-temp objects in at least one schema
could execute arbitrary SQL functions under a superuser identity.

While promptly updating PostgreSQL is the best remediation for most
users, a user unable to do that can work around the vulnerability by
disabling autovacuum, not manually running the above commands, and not
restoring from output of the pg_dump command. Performance may degrade
quickly under this workaround. VACUUM is safe, and all commands are fine
when a trusted user owns the target object.

Security: 157ce083-d145-11ec-ab9b-6cc21735f730
Release notes: https://www.postgresql.org/docs/release/

Details

Provenance
girgenAuthored on May 10 2022, 7:27 AM
Parents
R11:4a835475da61: security/vuxml: postgresql??-server vuln CVE-2022-1552
Branches
Unknown
Tags
Unknown