[ubuntu/bionic-security] postgresql-10 10.17-0ubuntu0.18.04.1 (Accepted)

[Marc Deslauriers]

postgresql-10 (10.17-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * New upstream version (LP: #1928773).

    + Prevent integer overflows in array subscripting calculations (Tom Lane)

      The array code previously did not complain about cases where an array's
      lower bound plus length overflows an integer.  This resulted in later
      entries in the array becoming inaccessible (since their subscripts could
      not be written as integers), but more importantly it confused subsequent
      assignment operations.  This could lead to memory overwrites, with
      ensuing crashes or unwanted data modifications. (CVE-2021-32027)

    + Fix mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE
      target lists (Tom Lane)

      If the UPDATE list contains any multi-column sub-selects (which give
      rise to junk columns in addition to the results proper), the UPDATE path
      would end up storing tuples that include the values of the extra junk
      columns. That's fairly harmless in the short run, but if new columns are
      added to the table then the values would become accessible, possibly
      leading to malfunctions if they don't match the datatypes of the added
      columns.

      In addition, in versions supporting cross-partition updates, a
      cross-partition update triggered by such a case had the reverse problem:
      the junk columns were removed from the target list, typically causing an
      immediate crash due to malfunction of the multi-column sub-select
      mechanism. (CVE-2021-32028)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/10/release-10-17.html

postgresql-10 (10.16-0ubuntu0.18.04.1) bionic; urgency=medium

  * New upstream version (LP: #1915254)
    + Fix CREATE INDEX CONCURRENTLY to wait for
      concurrent prepared transactions (Andrey Borodin)

      At the point where CREATE INDEX CONCURRENTLY
      waits for all concurrent transactions to complete so that it can see
      rows they inserted, it must also wait for all prepared transactions
      to complete, for the same reason.  Its failure to do so meant that
      rows inserted by prepared transactions might be omitted from the new
      index, causing queries relying on the index to miss such rows.
      In installations that have enabled prepared transactions
      (max_prepared_transactions > 0),
      it's recommended to reindex any concurrently-built indexes in
      case this problem occurred when they were built.

    + Details about this and many further changes can be found at:
      https://www.postgresql.org/docs/10/static/release-10-16.html

Date: 2021-05-31 15:04:09.498543+00:00
Changed-By: Christian Ehrhardt  <christian.ehrhardt at canonical.com>
Signed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/postgresql-10/10.17-0ubuntu0.18.04.1
-------------- next part --------------
Sorry, changesfile not available.