Bug 46620 - postgresql-9.6: Multiple issues (4.3)
postgresql-9.6: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-0-errata
Assigned To: Philipp Hahn
Arvid Requate
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-03-13 16:38 CET by Philipp Hahn
Modified: 2018-05-16 17:04 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 6.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2018-03-13 16:38:50 CET
New Debian postgresql-9.6 9.6.7-0+deb9u1 fixes:
This update addresses the following issues:
* Ensure that all temporary files made by pg_upgrade are non-world-readable
  (CVE-2018-1053)
* Change the behavior of contrib/cube's cube ~> int operator to make it
  compatible with KNN search. The meaning of the second argument (the
  dimension selector) has been changed to make it predictable which value is
  selected even when dealing with cubes of varying dimensionalities. This is
  an incompatible change, but since the point of the operator was to be used
  in KNN searches, it seems rather useless as-is. After installing this
  update, any expression indexes or materialized views using this operator
  will need to be reindexed/refreshed.

CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask
Comment 1 Philipp Hahn univentionstaff 2018-03-13 17:40:19 CET
[4.3-0] 796e07c3cb Bug #46620: postgresql-9.6_9.6.7-0+deb9u1
Comment 2 Quality Assurance univentionstaff 2018-05-04 16:44:08 CEST
--- mirror/ftp/4.3/unmaintained/4.3-0/source/postgresql-9.6_9.6.6-0+deb9u1.dsc
+++ apt/ucs_4.3-0-errata4.3-0/source/postgresql-9.6_9.6.7-0+deb9u1.dsc
@@ -1,3 +1,21 @@
+9.6.7-0+deb9u1 [Wed, 07 Feb 2018 15:01:25 +0100] Christoph Berg <christoph.berg@credativ.de>:
+
+  * New upstream version.
+    + Ensure that all temporary files made by pg_upgrade are
+      non-world-readable (CVE-2018-1053)
+
+    + Change the behavior of contrib/cube's cube ~> int operator to make it
+      compatible with KNN search.
+
+      The meaning of the second argument (the dimension selector) has been
+      changed to make it predictable which value is selected even when
+      dealing with cubes of varying dimensionalities.
+
+      This is an incompatible change, but since the point of the operator
+      was to be used in KNN searches, it seems rather useless as-is.
+      After installing this update, any expression indexes or materialized
+      views using this operator will need to be reindexed/refreshed.
+
 9.6.6-0+deb9u1 [Wed, 08 Nov 2017 10:40:59 +0100] Christoph Berg <christoph.berg@credativ.de>:
 
   * New upstream version.
Comment 3 Arvid Requate univentionstaff 2018-05-15 11:26:44 CEST
* No UCS specific patches
* Comparison to previously shipped version ok
* Binary package update Ok
* Advisory Ok
Comment 4 Arvid Requate univentionstaff 2018-05-16 17:04:00 CEST
<http://errata.software-univention.de/ucs/4.3/69.html>