[ubuntu/jammy-updates] postgresql-14 14.11-0ubuntu0.22.04.1 (Accepted)

Ubuntu Archive Robot ubuntu-archive-robot at lists.canonical.com
Mon Feb 26 13:58:35 UTC 2024

postgresql-14 (14.11-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * New upstream version (LP: #2052850).

    + A dump/restore is not required for those running 14.X.

    + However, one bug was fixed that could have resulted in corruption of
      GIN indexes during concurrent updates.  If you suspect such
      corruption, reindex affected indexes after installing this update.

    + Also, if you are upgrading from a version earlier than 14.10, see
      those release notes as well please.

    + Tighten security restrictions within REFRESH MATERIALIZED
      VIEW CONCURRENTLY (Heikki Linnakangas)

      One step of a concurrent refresh command was run under weak security
      restrictions.  If a materialized view's owner could persuade a
      superuser or other high-privileged user to perform a concurrent
      refresh on that view, the view's owner could control code executed
      with the privileges of the user running REFRESH.
      Fix things so that all user-determined code is run as the view's
      owner, as expected.

      The only known exploit for this error does not work in PostgreSQL
      16.0 and later, so it may be that v16 is not vulnerable in practice.

      The PostgreSQL Project thanks Pedro Gallegos for reporting this

    + Details about these and many further changes can be found at:

  * d/postgresql-14.NEWS: Update.

Date: 2024-02-20 17:41:09.837632+00:00
Changed-By: Sergio Durigan Junior <sergio.durigan at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
-------------- next part --------------
Sorry, changesfile not available.

More information about the jammy-changes mailing list