• Files Changed
• Browse Source

November 2023 Security Updates

• Files Changed
• Browse Source

- boo#1216734: Revert the last change and make the devel package
  independend of all other subpackages except for the libs.

- boo#1216022: Call install-alternatives from the devel subpackage
  as well, otherwise the symlink for ecpg might be missing.

- Also buildignore the postgresql*-implementation symbols: this is
  needed in order to bootstrap when no postgresql version currently
  has valid symbols provided. Once the packages are built, OBS
  could translate this to the pgname-* packages and accept the
  ignores; during bootstrap though, there is nothing providing the
  symbol and the existing buildignores do not suffice.

• Files Changed
• Browse Source

- Update to 11.21:
  * bsc#1214059, CVE-2023-39417: Disallow substituting a schema or
    owner name into an extension script if the name contains a
    quote, backslash, or dollar sign.
  * https://www.postgresql.org/docs/11/release-11-21.html

- Restore the independence of mini builds from the main build after
  the -mini name change from April 4, 2023.
- Adjust icu handling to prepare for PostgreSQL 16.

- Overhaul postgresql-README.SUSE and move it from the binary
  package to the noarch wrapper package.
- Change the unix domain socket location from /var/run to /run.

• Files Changed
• Browse Source

- Update to 11.20:
  * bsc#1211228, CVE-2023-2454:
    Prevent CREATE SCHEMA from defeating changes in search_path
  * bsc#1211229, CVE-2023-2455: Enforce row-level security
    policies correctly after inlining a set-returning function
  * https://www.postgresql.org/about/news/2637/
  * https://www.postgresql.org/docs/11/release-11-20.html

• Files Changed
• Browse Source

- bsc#1210303: Stop using the obsolete internal %_restart_on_update
  macro and drop support for sysv init to simplify the scriptlets.

• Files Changed
• Browse Source

- Update to 11.19:
  * https://www.postgresql.org/about/news/2592/
  * https://www.postgresql.org/docs/15/release-15-2.html
- Bump latest_supported_llvm_ver to 15.

• Files Changed
• Browse Source

- bsc#1205300: Update to 11.18:
  * https://www.postgresql.org/about/news/2543/
  * https://www.postgresql.org/docs/11/release-11-18.html
- Sync spec file with postgresql15.

• Files Changed
• Browse Source

- Create mechanism to specify the latest supported LLVM version.
  Automatically pin to that version if the distribution has a newer
  unsupported default version.
- Sync spec file with postgresql15.
- Disable LLVM JIT on riscv64

• Files Changed
• Browse Source

- Update to 11.17:
  * bsc#1202368, CVE-2022-2625: Extension scripts replace objects
    not belonging to the extension.
  * https://www.postgresql.org/docs/release/11.17/

• Files Changed
• Browse Source

- Upgrade to 11.16:
  * bsc#1199475, CVE-2022-1552: Confine additional operations
    within "security restricted operation" sandboxes.
  * https://www.postgresql.org/docs/11/release-11-16.html

• Files Changed
• Browse Source

- bsc#1198166: Pin to llvm13 until the next patchlevel update.

- bsc#1195680: Upgrade to 11.15:
  * https://www.postgresql.org/docs/11/release-11-15.html
  * Reindexing might be needed after applying this upgrade, so
    please read the release notes carefully.
- boo#1190740: Add constraints file with 12GB of memory for s390x
  as a workaround

• Files Changed
• Browse Source

- Add a llvmjit-devel subpackage to pull in the right versions
  of clang and llvm for building extensions. 
- Fix some mistakes in the interdependencies between the
  implementation packages and their noarch counterpart.
- Update the BuildIgnore section.

• Files Changed
• Browse Source

- bsc#1192516: Upgrade to version 11.14:
  * Make the server reject extraneous data after an SSL or GSS
    encryption handshake (CVE-2021-23214).
  * Make libpq reject extraneous data after an SSL or GSS
    encryption handshake (CVE-2021-23222).
  * https://www.postgresql.org/docs/11/release-11-14.html

• Files Changed
• Browse Source

- Let genlists skip non-existing binaries to avoid lots of version
  conditionals in the file lists.
- Remove postgresql-testsuite-int8.sql.patch, because its purpose
  is unclear. This affects only the test subpackage.

• Files Changed
• Browse Source

- bsc#1185952: fix build with llvm12 on s390x.
  0001-jit-Workaround-potential-datalayout-mismatch-on-s390.patch 
- bsc#1179945: Re-enable icu for PostgreSQL 10.

- Upgrade to version 11.13:
  * https://www.postgresql.org/docs/11/release-11-13.html
  * CVE-2021-3677 (boo#1189748)
    The planner could create an incorrect plan in cases where two
    ProjectionPaths were stacked on top of each other. The only
    known way to trigger that situation involves parallel sort
    operations, but there may be other instances. The result would
    be crashes or incorrect query results. Disclosure of server
    memory contents is also possible.

- bsc#1187751: Make the dependency of postgresqlXX-server-devel on
  llvm and clang optional (postgresql-llvm-optional.patch).

• Files Changed
• Browse Source

- Upgrade to version 11.12:
  * https://www.postgresql.org/docs/11/release-11-12.html
  * CVE-2021-32027, bsc#1185924:
    Prevent integer overflows in array subscripting calculations.
  * CVE-2021-32028, bsc#1185925: Fix mishandling of “junk”
    columns in INSERT ... ON CONFLICT ... UPDATE target lists.
  * CVE-2021-32029, bsc#1185926: Fix possibly-incorrect
    computation of UPDATE ... RETURNING
    "pg_psql_temporary_savepoint" does not exist”.
- Don't use %_stop_on_removal, because it was meant to be private
  and got removed from openSUSE. %_restart_on_update is also
  private, but still supported and needed for now (bsc#1183168).

  only be delivered on PackageHub for now (boo#1183118).

• Files Changed
• Browse Source

- Re-enable build of the llvmjit subpackage on SLE, but it will
  only be delivered on PackageHub for now.

• Files Changed
• Browse Source

- Remove leftover PreReq on chkconfig, we stopped using it long
  time ago.

• Files Changed
• Browse Source

- boo#1179945: Disable icu for PostgreSQL 10 (and older) on TW.

Upgrade to version 11.11:
  * https://www.postgresql.org/docs/11/release-11-11.html  
  * Reindexing might be needed after applying this update.
  * CVE-2021-3393, bsc#1182040: Fix information leakage in
    constraint-violation error messages.
  * Obsoletes postgresql-icu68.patch.

• Files Changed
• Browse Source