Bug 46620

Summary:	postgresql-9.6: Multiple issues (4.3)
Product:	UCS	Reporter:	Philipp Hahn <hahn>
Component:	Security updates	Assignee:	Philipp Hahn <hahn>
Status:	CLOSED FIXED	QA Contact:	Arvid Requate <requate>
Severity:	normal
Priority:	P3	CC:	requate
Version:	UCS 4.3
Target Milestone:	UCS 4.3-0-errata
Hardware:	All
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:	6.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)

Description Philipp Hahn

2018-03-13 16:38:50 CET

New Debian postgresql-9.6 9.6.7-0+deb9u1 fixes:
This update addresses the following issues:
* Ensure that all temporary files made by pg_upgrade are non-world-readable
  (CVE-2018-1053)
* Change the behavior of contrib/cube's cube ~> int operator to make it
  compatible with KNN search. The meaning of the second argument (the
  dimension selector) has been changed to make it predictable which value is
  selected even when dealing with cubes of varying dimensionalities. This is
  an incompatible change, but since the point of the operator was to be used
  in KNN searches, it seems rather useless as-is. After installing this
  update, any expression indexes or materialized views using this operator
  will need to be reindexed/refreshed.

CVE-2018-1053 postgresql: pg_upgrade creates file of sensitive metadata under prevailing umask

Comment 1 Philipp Hahn

2018-03-13 17:40:19 CET

[4.3-0] 796e07c3cb Bug #46620: postgresql-9.6_9.6.7-0+deb9u1

Comment 2 Quality Assurance

2018-05-04 16:44:08 CEST

--- mirror/ftp/4.3/unmaintained/4.3-0/source/postgresql-9.6_9.6.6-0+deb9u1.dsc
+++ apt/ucs_4.3-0-errata4.3-0/source/postgresql-9.6_9.6.7-0+deb9u1.dsc
@@ -1,3 +1,21 @@
+9.6.7-0+deb9u1 [Wed, 07 Feb 2018 15:01:25 +0100] Christoph Berg <christoph.berg@credativ.de>:
+
+  * New upstream version.
+    + Ensure that all temporary files made by pg_upgrade are
+      non-world-readable (CVE-2018-1053)
+
+    + Change the behavior of contrib/cube's cube ~> int operator to make it
+      compatible with KNN search.
+
+      The meaning of the second argument (the dimension selector) has been
+      changed to make it predictable which value is selected even when
+      dealing with cubes of varying dimensionalities.
+
+      This is an incompatible change, but since the point of the operator
+      was to be used in KNN searches, it seems rather useless as-is.
+      After installing this update, any expression indexes or materialized
+      views using this operator will need to be reindexed/refreshed.
+
 9.6.6-0+deb9u1 [Wed, 08 Nov 2017 10:40:59 +0100] Christoph Berg <christoph.berg@credativ.de>:
 
   * New upstream version.

Comment 3 Arvid Requate

2018-05-15 11:26:44 CEST

* No UCS specific patches
* Comparison to previously shipped version ok
* Binary package update Ok
* Advisory Ok

Comment 4 Arvid Requate

2018-05-16 17:04:00 CEST

<http://errata.software-univention.de/ucs/4.3/69.html>