Bug 46620 – postgresql-9.6: Multiple issues (4.3)

Bug 46620 - postgresql-9.6: Multiple issues (4.3)


Summary:	postgresql-9.6: Multiple issues (4.3)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 4.3
Hardware:	All Linux

Importance:	P3 normal (vote)
Target Milestone:	UCS 4.3-0-errata
Assigned To:	Philipp Hahn
QA Contact:	Arvid Requate

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2018-03-13 16:38 CET by Philipp Hahn
Modified:	2018-05-16 17:04 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:	6.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Philipp Hahn

2018-03-13 16:38:50 CET

New Debian postgresql-9.6 9.6.7-0+deb9u1 fixes:
This update addresses the following issues:
* Ensure that all temporary files made by pg_upgrade are non-world-readable
  (CVE-2018-1053)
* Change the behavior of contrib/cube's cube ~> int operator to make it
  compatible with KNN search. The meaning of the second argument (the
  dimension selector) has been changed to make it predictable which value is
  selected even when dealing with cubes of varying dimensionalities. This is
  an incompatible change, but since the point of the operator was to be used
  in KNN searches, it seems rather useless as-is. After installing this
  update, any expression indexes or materialized views using this operator
  will need to be reindexed/refreshed.

CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask

Comment 1 Philipp Hahn

2018-03-13 17:40:19 CET

[4.3-0] 796e07c3cb Bug #46620: postgresql-9.6_9.6.7-0+deb9u1

Comment 2 Quality Assurance

2018-05-04 16:44:08 CEST

--- mirror/ftp/4.3/unmaintained/4.3-0/source/postgresql-9.6_9.6.6-0+deb9u1.dsc
+++ apt/ucs_4.3-0-errata4.3-0/source/postgresql-9.6_9.6.7-0+deb9u1.dsc
@@ -1,3 +1,21 @@
+9.6.7-0+deb9u1 [Wed, 07 Feb 2018 15:01:25 +0100] Christoph Berg <christoph.berg@credativ.de>:
+
+  * New upstream version.
+    + Ensure that all temporary files made by pg_upgrade are
+      non-world-readable (CVE-2018-1053)
+
+    + Change the behavior of contrib/cube's cube ~> int operator to make it
+      compatible with KNN search.
+
+      The meaning of the second argument (the dimension selector) has been
+      changed to make it predictable which value is selected even when
+      dealing with cubes of varying dimensionalities.
+
+      This is an incompatible change, but since the point of the operator
+      was to be used in KNN searches, it seems rather useless as-is.
+      After installing this update, any expression indexes or materialized
+      views using this operator will need to be reindexed/refreshed.
+
 9.6.6-0+deb9u1 [Wed, 08 Nov 2017 10:40:59 +0100] Christoph Berg <christoph.berg@credativ.de>:
 
   * New upstream version.

Comment 3 Arvid Requate

2018-05-15 11:26:44 CEST

* No UCS specific patches
* Comparison to previously shipped version ok
* Binary package update Ok
* Advisory Ok

Comment 4 Arvid Requate

2018-05-16 17:04:00 CEST

<http://errata.software-univention.de/ucs/4.3/69.html>