MFH: r526063 r527871

The PostgreSQL Global Development Group has released an update to all
supported versions of our database system, including 12.2, 11.7, 10.12,
9.6.17, 9.5.21, and 9.4.26. This release fixes one security issue found
in the PostgreSQL server and over 75 bugs reported over the last three
months.

Users should plan to update as soon as possible.

PostgreSQL 9.4 Now EOL

This is the last release for PostgreSQL 9.4, which will no longer
receive security updates and bug fixes. PostgreSQL 9.4 introduced new
features such as JSONB support, the ALTER SYSTEM command, the ability
to stream logical changes to an output plugin, and more:

https://www.postgresql.org/about/news/1557/
https://www.postgresql.org/docs/9.4/release-9-4.html

While we are very proud of this release, these features are also found
in newer versions of PostgreSQL. Many of these features have also
received improvements, and, per our versioning policy, it is time to
retire PostgreSQL 9.4.

To receive continued support, we suggest that you make plans to upgrade
to a newer, supported version of PostgreSQL. Please see the PostgreSQL
versioning policy for more information.

Security Issues

• CVE-2020-1720: ALTER ... DEPENDS ON EXTENSION is missing

authorization checks.

Versions Affected: 9.6 - 12

The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform
authorization checks, which can allow an unprivileged user to drop any
function, procedure, materialized view, index, or trigger under certain
conditions. This attack is possible if an administrator has installed an
extension and an unprivileged user can CREATE, or an extension owner
either executes DROP EXTENSION predictably or can be convinced to
execute DROP EXTENSION.

Release notes: https://www.postgresql.org/docs/current/release.html

databases/postgresql12-server: fix build on GCC architectures

Use LLVM only if Clang is used.

PR: 244225, 244985
Approved by: ports-secteam (joneum)