Quick Links

postgresql-13 updated to version 13.2-1.pgdg+1

From:	apt(dot)postgresql(dot)org Repository Update <noreply(at)postgresql(dot)org>
To:	PostgreSQL on Debian and Ubuntu <pgsql-pkg-debian(at)lists(dot)postgresql(dot)org>
Subject:	postgresql-13 updated to version 13.2-1.pgdg+1
Date:	2021-02-11 12:37:21
Message-ID:	E1lABDl-0004Sq-6p@atalia.postgresql.org
Views:	Raw Message \| Whole Thread \| Download mbox \| Resend email
Thread:
Lists:	pgsql-pkg-debian

The package postgresql-13 was updated on apt.postgresql.org.

apt-listchanges: Changelogs
---------------------------

postgresql-13 (13.2-1.pgdg+1) sid-pgdg; urgency=medium

* Rebuild for sid-pgdg.
* Changes applied by generate-pgdg-source:
+ Enabling cassert.

-- PostgreSQL on Debian and Ubuntu <pgsql-pkg-debian(at)lists(dot)postgresql(dot)org> Wed, 10 Feb 2021 17:33:55 +0100

postgresql-13 (13.2-1) unstable; urgency=medium

* New upstream version.

+ Fix failure to check per-column SELECT privileges in some join queries
(Tom Lane)

In some cases involving joins, the parser failed to record all the
columns read by a query in the column-usage bitmaps that are used for
permissions checking. Although the executor would still insist on some
sort of SELECT privilege to run the query, this meant that a user having
SELECT privilege on only one column of a table could nonetheless read
all its columns through a suitably crafted query.

A stored view that is subject to this problem will have incomplete
column-usage bitmaps, and thus permissions will still not be enforced
properly on the view after updating. In installations that depend on
column-level permissions for security, it is recommended to CREATE OR
REPLACE all user-defined views to cause them to be re-parsed.

The PostgreSQL Project thanks Sven Klemm for reporting this problem.
(CVE-2021-20229)

+ Fix information leakage in constraint-violation error messages
(Heikki Linnakangas)

If an UPDATE command attempts to move a row to a different partition but
finds that it violates some constraint on the new partition, and the
columns in that partition are in different physical positions than in
the parent table, the error message could reveal the contents of columns
that the user does not have SELECT privilege on. (CVE-2021-3393)

+ Fix incorrect detection of concurrent page splits while inserting into a
GiST index (Heikki Linnakangas)

Concurrent insertions could lead to a corrupt index with entries placed
in the wrong pages. It's recommended to reindex any GiST index that's
been subject to concurrent insertions.

+ Fix CREATE INDEX CONCURRENTLY to wait for concurrent prepared
transactions (Andrey Borodin)

At the point where CREATE INDEX CONCURRENTLY waits for all concurrent
transactions to complete so that it can see rows they inserted, it must
also wait for all prepared transactions to complete, for the same
reason. Its failure to do so meant that rows inserted by prepared
transactions might be omitted from the new index, causing queries
relying on the index to miss such rows. In installations that have
enabled prepared transactions (max_prepared_transactions > 0), it's
recommended to reindex any concurrently-built indexes in case this
problem occurred when they were built.

[ Christoph Berg ]
* Remove obsolete --enable-integer-datetimes configure option.
(Closes: #974988)
* Modernize server package description.
* Use xsltproc --nonet.
* run-testsuite: Test only this version.

[ Helmut Grohne ]
* Reduce Build-Depends: (Closes: #979456)
+ gdb is only used for testing.

-- Christoph Berg <myon(at)debian(dot)org> Wed, 10 Feb 2021 17:33:55 +0100

New version 13.2-1.pgdg+1:

The public mirrors serving apt.postgresql.org are synced hourly,
the updated packages will be available there shortly.

Browse pgsql-pkg-debian by date

	From	Date	Subject
Next Message	apt.postgresql.org Repository Update	2021-02-11 12:37:34	postgresql-12 updated to version 12.6-1.pgdg+1
Previous Message	apt.postgresql.org Repository Update	2021-02-11 12:37:04	postgresql-common updated to version 225.pgdg+1