Accepted postgresql-16 16.2-1 (source) into unstable
- To: debian-devel-changes@lists.debian.org
- Subject: Accepted postgresql-16 16.2-1 (source) into unstable
- From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
- Date: Thu, 08 Feb 2024 12:51:17 +0000
- Debian: DAK
- Debian-architecture: source
- Debian-archive-action: accept
- Debian-changes: postgresql-16_16.2-1_source.changes
- Debian-source: postgresql-16
- Debian-suite: unstable
- Debian-version: 16.2-1
- Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id: Content-Transfer-Encoding:Content-Type:Subject:MIME-Version:To:Reply-To:From: Cc:Content-ID:Content-Description:In-Reply-To:References; bh=+drx+rQnJ4iOO+mOT3QyBCX0e6dvOXjoi1ZdlfEYa5E=; b=tNWxv2VKxugul+BXqpmDT/SBIO PngKH7feBTg4MIVzdvBlt6HX+fqsb5ITtxt1AeFatZp5bFwUt+u789gjTLNVCibBJCkPmziE0pFmq KDfdVxF5Xy92HmlT30AwGGj2T4rvExAZMycxqcvUB/s50S3jha2VoufgZou7G+dyt01JpSNJKMU7y G92T6h0YynAv3JE0Il9c5tTUyCJhq5QFcTyknca+/VIHrYzglh2sJ7FdzdguCW5pzMPU8QtayYyou U9ByeIXMgJqoz6n9Rn7KZgMIt+x+iQBeeMs0oOGq2EKcHObK0yJZl/8HzOtWlugrlhlFYiAsZxyFe C0Vd/Xwg==;
- Mail-followup-to: debian-devel@lists.debian.org
- Message-id: <E1rY3s5-008ET3-3M@fasolo.debian.org>
- Reply-to: debian-devel@lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 06 Feb 2024 13:27:57 +0100
Source: postgresql-16
Architecture: source
Version: 16.2-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PostgreSQL Maintainers <team+postgresql@tracker.debian.org>
Changed-By: Christoph Berg <myon@debian.org>
Closes: 1059170
Changes:
postgresql-16 (16.2-1) unstable; urgency=medium
.
* New upstream version.
.
* Tighten security restrictions within REFRESH MATERIALIZED VIEW
CONCURRENTLY (Heikki Linnakangas)
.
One step of a concurrent refresh command was run under weak security
restrictions. If a materialized view's owner could persuade a superuser
or other high-privileged user to perform a concurrent refresh on that
view, the view's owner could control code executed with the privileges
of the user running REFRESH. Fix things so that all user-determined code
is run as the view's owner, as expected.
.
The only known exploit for this error does not work in PostgreSQL 16.0
and later, so it may be that v16 is not vulnerable in practice.
.
The PostgreSQL Project thanks Pedro Gallegos for reporting this problem.
(CVE-2024-0985)
.
* Add Swedish debconf translation by Martin Bagge and Anders Jonsson.
Thanks! (Closes: #1059170)
Checksums-Sha1:
20a964e8739f4686663660da7830b5e4c356c9cd 4187 postgresql-16_16.2-1.dsc
fc3d0e598410bbdf59f240821c9c77a6936467b6 24711703 postgresql-16_16.2.orig.tar.bz2
d5129d385f9ffcd2408d01efe41525f87721d4c6 31264 postgresql-16_16.2-1.debian.tar.xz
Checksums-Sha256:
2700b610a315b627632e3d6cc11103707e78048c59272fa6ef2aeeab1f0541f5 4187 postgresql-16_16.2-1.dsc
446e88294dbc2c9085ab4b7061a646fa604b4bec03521d5ea671c2e5ad9b2952 24711703 postgresql-16_16.2.orig.tar.bz2
6eaa133ec2240213b1bab0e59c800353d2ec18af2d48c1c1f60fbbb7f1096fa0 31264 postgresql-16_16.2-1.debian.tar.xz
Files:
d72056af8106c89485f61651dfa4a87f 4187 database optional postgresql-16_16.2-1.dsc
3d19d93434666db5d33e692472915ae5 24711703 database optional postgresql-16_16.2.orig.tar.bz2
426fa2f98e9f58313b95affbf40a4575 31264 database optional postgresql-16_16.2-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmXEy4MACgkQTFprqxLS
p64awA//R3CFj72MWz7x08yHkfwd+HBQMcaBWFelAZPQ+5U9opV1C8JxtjWgP9Dy
wsSZk703nHNZhM+stgOwMpAsblrm/RHK7anDd78pekMTstSaHEFGLsPVo4FDfGOl
LmnJHj64JxpQb3Ms2MH+8tTJjlAE0nfYJiU+KFKXmwKIVwItTBeN+QWP1xnbjsux
q3zMIyzOWjcYeLhlwqdz73lEeHkmAyUHbCokJ3UoSCQp/Diu6A37ebwlczDyT+hL
4HOUtIYn/XqolpJHLO0DQTs5C1L9f0Dqf+ZYycHAgxBfJuUtteeB/AvZjsKLd60L
2NA1LedDbhBMcF+rBsbAhnIKAzXTK0pc/pN13kY5QrSbnuKRWvsIA564t39KvVH/
ZXQC7XXiRuo4z5UIhAcnn39m/2Nj8LRJdM94eFs0dMY5w+Yk7kTlOqXv57YIL0S8
9SIupPAuFUUhDmLjX2J32bVcMVwsIgmZIFvOeLzxSpg8ENl/NqUvy8IULWIUcg1l
f9Mi89+l5Cj7jKwTWCfxFXgHSS3LAzdPFWZmR6ebFuEFCYrI4ZRQCRhvIsj+qfnv
UPnihwB+6MhJdKB5k80Z1adUQR1ZWgRQBNLWPFg6/6hScKpDtVQQV6toOikhvw8Z
c4GqcKjUTKK8xeQqQH2wecTOY4CO/dxKvwZdUmA2LjdwqyKvMh8=
=gsg2
-----END PGP SIGNATURE-----