-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 07 Aug 2024 16:09:15 +0200 Source: postgresql-13 Binary: libecpg-compat3 libecpg-compat3-dbgsym libecpg-dev libecpg-dev-dbgsym libecpg6 libecpg6-dbgsym libpgtypes3 libpgtypes3-dbgsym libpq-dev libpq5 libpq5-dbgsym postgresql-13 postgresql-13-dbgsym postgresql-client-13 postgresql-client-13-dbgsym postgresql-plperl-13 postgresql-plperl-13-dbgsym postgresql-plpython3-13 postgresql-plpython3-13-dbgsym postgresql-pltcl-13 postgresql-pltcl-13-dbgsym postgresql-server-dev-13 Architecture: amd64 Version: 13.16-0+deb11u1 Distribution: bullseye-security Urgency: medium Maintainer: amd64 Build Daemon (x86-grnet-03) Changed-By: Christoph Berg Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 13 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql-13 - The World's Most Advanced Open Source Relational Database postgresql-client-13 - front-end programs for PostgreSQL 13 postgresql-plperl-13 - PL/Perl procedural language for PostgreSQL 13 postgresql-plpython3-13 - PL/Python 3 procedural language for PostgreSQL 13 postgresql-pltcl-13 - PL/Tcl procedural language for PostgreSQL 13 postgresql-server-dev-13 - development files for PostgreSQL 13 server-side programming Changes: postgresql-13 (13.16-0+deb11u1) bullseye-security; urgency=medium . * New upstream version. . + Prevent unauthorized code execution during pg_dump (Masahiko Sawada) . An attacker able to create and drop non-temporary objects could inject SQL code that would be executed by a concurrent pg_dump session with the privileges of the role running pg_dump (which is often a superuser). The attack involves replacing a sequence or similar object with a view or foreign table that will execute malicious code. To prevent this, introduce a new server parameter restrict_nonsystem_relation_kind that can disable expansion of non-builtin views as well as access to foreign tables, and teach pg_dump to set it when available. Note that the attack is prevented only if both pg_dump and the server it is dumping from are new enough to have this fix. . The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2024-7348) Checksums-Sha1: 078cdac0fb9bf1cba7f554879fe72ce661fc23c8 38060 libecpg-compat3-dbgsym_13.16-0+deb11u1_amd64.deb ef24dac4c110fa846e7c959d52ae0189af1c1a45 27472 libecpg-compat3_13.16-0+deb11u1_amd64.deb 86b83003db0aa30434a7470d9b26370983b54746 226184 libecpg-dev-dbgsym_13.16-0+deb11u1_amd64.deb 37cf0a7483a5ff8e228b2761224f0ee8b9b462c4 286628 libecpg-dev_13.16-0+deb11u1_amd64.deb 88d212e6d76bcdeab658ca4099b37d4fcad8781a 111200 libecpg6-dbgsym_13.16-0+deb11u1_amd64.deb bf7ac65f45531cdb86620fd3b02c08821af22132 63444 libecpg6_13.16-0+deb11u1_amd64.deb 46e28447c95b07577799096000e0187c96b2ea20 89072 libpgtypes3-dbgsym_13.16-0+deb11u1_amd64.deb 1abb1fdee73562c9e85a48c30d5db62e18c1fbd5 49712 libpgtypes3_13.16-0+deb11u1_amd64.deb f1adcf78e659627bc546e2e242840e264f38368e 142068 libpq-dev_13.16-0+deb11u1_amd64.deb 13e0644417a254638d07c2712fde3f9a069bfe28 253848 libpq5-dbgsym_13.16-0+deb11u1_amd64.deb dbb4d67ea6bb5ceb7179a864eecdfe04f2ae5acd 182772 libpq5_13.16-0+deb11u1_amd64.deb 85357cb030ef2caca8dfc6d93c5c9552ffa963bf 15041192 postgresql-13-dbgsym_13.16-0+deb11u1_amd64.deb 5a4585be79e6bfab8faf9c9130a912fe7f11bd38 16407 postgresql-13_13.16-0+deb11u1_amd64-buildd.buildinfo 8317d22cb48abb87f30cd3f081009e4a15c83699 15196108 postgresql-13_13.16-0+deb11u1_amd64.deb fe9f0b73ca872f956936e2905237fdc6e306e3d1 1856020 postgresql-client-13-dbgsym_13.16-0+deb11u1_amd64.deb ea5e07da4643a0a2f403579ebb2b1222749b1be2 1515688 postgresql-client-13_13.16-0+deb11u1_amd64.deb 8953835c0e75dfcbaa82a52e7b87f1a116e474d1 157668 postgresql-plperl-13-dbgsym_13.16-0+deb11u1_amd64.deb ddbe1e1db8fa77088f621e966dee1833b0de76c5 89836 postgresql-plperl-13_13.16-0+deb11u1_amd64.deb eab344a7a49b82c38676a040709d4fc4b8caef42 159664 postgresql-plpython3-13-dbgsym_13.16-0+deb11u1_amd64.deb a6af02c4307ee5d12f2d664d2cb8ad2f717f16bc 110092 postgresql-plpython3-13_13.16-0+deb11u1_amd64.deb 616ca093e3896ec6eebd6dee381b1b610744e093 74900 postgresql-pltcl-13-dbgsym_13.16-0+deb11u1_amd64.deb 1c2c1f36fd5f382d0a751f352ce6fbc70c7abbc8 43984 postgresql-pltcl-13_13.16-0+deb11u1_amd64.deb c42014fa476d5d164dca8506312b7da7a062dacf 1042952 postgresql-server-dev-13_13.16-0+deb11u1_amd64.deb Checksums-Sha256: 70666b29980896188dec3d754e420128357e1d0628eb03368b17b618893f05d6 38060 libecpg-compat3-dbgsym_13.16-0+deb11u1_amd64.deb 8bdaa6fd3a62c34a84d3b9f672f09bdbbc40ef12e221a99d7cb826c82da8112c 27472 libecpg-compat3_13.16-0+deb11u1_amd64.deb 436b538c3930e3c35ede8e4c542bcd4703d48e842f211db89a6be7e02652ad0a 226184 libecpg-dev-dbgsym_13.16-0+deb11u1_amd64.deb f2eb29d31180e3b47d7dc7c352ae0c4ea362e36396d5ddd79e7971bf34f5604e 286628 libecpg-dev_13.16-0+deb11u1_amd64.deb 12e1439642a7f0528fb9311f3c41a7b5cc1350c64db8eade95f8667d8df964cc 111200 libecpg6-dbgsym_13.16-0+deb11u1_amd64.deb d44910ec2b1cf469c4a6b646bab8a844c7389819b755ec39d54fcf6f6a90a17f 63444 libecpg6_13.16-0+deb11u1_amd64.deb 60192215f3957ab9603893bd3e7e2d4a0dd761605d7f4a583fb1e041db1ad0f4 89072 libpgtypes3-dbgsym_13.16-0+deb11u1_amd64.deb 242afbcaa3c508d3b0dadca1fee950dfb4cd86bdabb06bdfd9025cb1c50e4383 49712 libpgtypes3_13.16-0+deb11u1_amd64.deb db823e8dd574c9222437256bf0002629b9778236d63c8389082688c5f942ee00 142068 libpq-dev_13.16-0+deb11u1_amd64.deb e23a11e970c4a0aa9849646a5aeb3e09295bdf9e344ecff8f9e0bb592d4eb728 253848 libpq5-dbgsym_13.16-0+deb11u1_amd64.deb d8e93538920971ed3fde36f1757d32676460419dd12619b037a0602fd3dade15 182772 libpq5_13.16-0+deb11u1_amd64.deb b93f4d9b847717c88003cf8fe920c61fad1b5bccbded4e1a85f60abac07f93c9 15041192 postgresql-13-dbgsym_13.16-0+deb11u1_amd64.deb 5c5ef8fcd1c390158752f841e49e0245135dda5ef4bbb9bcfe5c907989b35da2 16407 postgresql-13_13.16-0+deb11u1_amd64-buildd.buildinfo bc484764707e67d5a40b51f24e45b666f5c1c2d782ae4b48127756cb36d5c6c7 15196108 postgresql-13_13.16-0+deb11u1_amd64.deb c9b9150096d3776731b712720377640620b561d7b440d4cc0440f8fad99d0ca3 1856020 postgresql-client-13-dbgsym_13.16-0+deb11u1_amd64.deb 32a6cf969a653c6925ec396dd3e75f482a3e29e91f05b7274cadfae4d19fe169 1515688 postgresql-client-13_13.16-0+deb11u1_amd64.deb 40f5c7ddc160a01599ce34cde12c4c83bc24b7197d10f03fa2324ffe0d7f8197 157668 postgresql-plperl-13-dbgsym_13.16-0+deb11u1_amd64.deb 2fcef054f4a2339e069acaec05b55f905f02fc10bc31a5ccfac7a856912ee728 89836 postgresql-plperl-13_13.16-0+deb11u1_amd64.deb 8873ea4709de940619dcdbeaea6ab167c6314feea784a9a900b23fced4909414 159664 postgresql-plpython3-13-dbgsym_13.16-0+deb11u1_amd64.deb c65fd1b9ac125b24dc04db34fa9eb985fa43d906139eb193f39b197af24c42c5 110092 postgresql-plpython3-13_13.16-0+deb11u1_amd64.deb 956e1d34440c25b26e2ab41ab83abba6def30863a834187bef9e1c79aa03efc8 74900 postgresql-pltcl-13-dbgsym_13.16-0+deb11u1_amd64.deb c4b2ff23812f4eefee3c699409a1fd905191799b3516d1351248f5c659ef850d 43984 postgresql-pltcl-13_13.16-0+deb11u1_amd64.deb 66398d4dd99e8d61a0a91ea391437c203790b276542e90bacf8a42ad1f1517de 1042952 postgresql-server-dev-13_13.16-0+deb11u1_amd64.deb Files: 02cd6444ab87b323c9961eda1ca183e3 38060 debug optional libecpg-compat3-dbgsym_13.16-0+deb11u1_amd64.deb 60041065e881b680f53a0f666fe60f0c 27472 libs optional libecpg-compat3_13.16-0+deb11u1_amd64.deb 3706c3caddd4175bc188bfdf528af1c3 226184 debug optional libecpg-dev-dbgsym_13.16-0+deb11u1_amd64.deb 41a3b6176c55a41914e755cd778e3f3e 286628 libdevel optional libecpg-dev_13.16-0+deb11u1_amd64.deb 1b3ee452fd75fc27bb9c0211e59180ec 111200 debug optional libecpg6-dbgsym_13.16-0+deb11u1_amd64.deb b31548ad9318ca9111e583679af6e1e5 63444 libs optional libecpg6_13.16-0+deb11u1_amd64.deb e87ec65f35b58f0240040b18b5500f3a 89072 debug optional libpgtypes3-dbgsym_13.16-0+deb11u1_amd64.deb def61e97a4c167dcb0cb449f2010918a 49712 libs optional libpgtypes3_13.16-0+deb11u1_amd64.deb ed024d0b75a6dc0ec514ce3c92b5f405 142068 libdevel optional libpq-dev_13.16-0+deb11u1_amd64.deb 07cf57534c3ed4dde3b1904d1d9d8ec5 253848 debug optional libpq5-dbgsym_13.16-0+deb11u1_amd64.deb fc8b086179562b1fca8c11122e72188f 182772 libs optional libpq5_13.16-0+deb11u1_amd64.deb 4be3cee3c16ab6fc66fd9372c7f9d496 15041192 debug optional postgresql-13-dbgsym_13.16-0+deb11u1_amd64.deb b5aecc10040e082189eb3a69163902e9 16407 database optional postgresql-13_13.16-0+deb11u1_amd64-buildd.buildinfo 6a0ed0008094a35c68fef3337698d86d 15196108 database optional postgresql-13_13.16-0+deb11u1_amd64.deb 2e70836092ba0b6bca3a4e90cce4d020 1856020 debug optional postgresql-client-13-dbgsym_13.16-0+deb11u1_amd64.deb 6fd63f916eb8355e965beb6e198c8e32 1515688 database optional postgresql-client-13_13.16-0+deb11u1_amd64.deb d967e71bccf6f0dfeb13958ab996a633 157668 debug optional postgresql-plperl-13-dbgsym_13.16-0+deb11u1_amd64.deb cb6e117c8e48fdb8ec1f984c1bbd0e7d 89836 database optional postgresql-plperl-13_13.16-0+deb11u1_amd64.deb c736bc8c24fe79dbb5d01e857665bb3a 159664 debug optional postgresql-plpython3-13-dbgsym_13.16-0+deb11u1_amd64.deb d51074d856a082e6484c60d12f47a8f3 110092 database optional postgresql-plpython3-13_13.16-0+deb11u1_amd64.deb 1ed233b5bc05553ab46c08a28d460a0a 74900 debug optional postgresql-pltcl-13-dbgsym_13.16-0+deb11u1_amd64.deb 4453a561ed30ce574de9ed6a743102cc 43984 database optional postgresql-pltcl-13_13.16-0+deb11u1_amd64.deb 4ea418d92126ffeb7cef80d7e489a2af 1042952 libdevel optional postgresql-server-dev-13_13.16-0+deb11u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEe8x49oT2k+seQstpgDm7h4zfCpIFAma04uIACgkQgDm7h4zf CpLIwRAAkmRBUgPT8ZDMXR8ZiZXyUYe+KEV0cqPCTg1JkzO1nGcnsBN99WTIlG7U u+aF//2LDYP1VdMgJKrZ+cfq0gqMiOwE3PqB9tpCS/uayL1v0cV41R7UQaonTOXj l03dUmdTZgCUti47iDS1p5EglkJ0Xuupwk12FCNCRvCsRW5pI+3TjaZuoktzIIbI M80R1O7sE9KSNByewJJ8k9dvzCncBPvckdV38OXUMlq8ioBCgPKVGOI0jryisNPp gQNrgV5eXhNMGZwkTihRxw3EsbCI5s53WEtrxsr2C542BYWH8TT9cj8f9DCRhQ7U Y8lvUjfIexoaHIYPXe6oUJOOEn9c1LhlbahmYIe7ZP2PqBmc+n2SyHaOkI0EhI9C s887YExEt0PMr7XI+RC96xErDaM3OkHfopSYigHrzqO6dFR3SchHLA4/JbSEy6Eq C6b+5ICMxtmR7atrhPDsUIM9CfM/MQ0rTEic57khM2GX1kJ93xS1/EQKooVtxrZu 39Mw0X/8tTfmMYbNOUFZOKk0VCt6aEjm8R5Cu1nzHW0kh77ny5nMp0TXMjnspUpM vLIfGkrL3DOGkCvQTEUPLclqYx387g4H2qVCupZhLNZcGaUGeKKwLCnMvyRMvzDc bKHVBp1UEx0GUhjodIKf16oM31hIyo1ZD276sbMzQrY+gVOxCzA= =AAnY -----END PGP SIGNATURE-----