-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 07 May 2019 12:51:42 +0200 Source: postgresql-9.6 Binary: libpq-dev libpq5 libecpg6 libecpg-dev libecpg-compat3 libpgtypes3 postgresql-9.6 postgresql-9.6-dbg postgresql-client-9.6 postgresql-server-dev-9.6 postgresql-doc-9.6 postgresql-contrib-9.6 postgresql-plperl-9.6 postgresql-plpython-9.6 postgresql-plpython3-9.6 postgresql-pltcl-9.6 Architecture: i386 Version: 9.6.13-0+deb9u1 Distribution: stretch-security Urgency: medium Maintainer: i386 Build Daemon (x86-grnet-01) Changed-By: Christoph Berg Description: libecpg-compat3 - older version of run-time library for ECPG programs libecpg-dev - development files for ECPG (Embedded PostgreSQL for C) libecpg6 - run-time library for ECPG programs libpgtypes3 - shared library libpgtypes for PostgreSQL 9.6 libpq-dev - header files for libpq5 (PostgreSQL library) libpq5 - PostgreSQL C client library postgresql-9.6 - object-relational SQL database, version 9.6 server postgresql-9.6-dbg - debug symbols for postgresql-9.6 postgresql-client-9.6 - front-end programs for PostgreSQL 9.6 postgresql-contrib-9.6 - additional facilities for PostgreSQL postgresql-doc-9.6 - documentation for the PostgreSQL database management system postgresql-plperl-9.6 - PL/Perl procedural language for PostgreSQL 9.6 postgresql-plpython-9.6 - PL/Python procedural language for PostgreSQL 9.6 postgresql-plpython3-9.6 - PL/Python 3 procedural language for PostgreSQL 9.6 postgresql-pltcl-9.6 - PL/Tcl procedural language for PostgreSQL 9.6 postgresql-server-dev-9.6 - development files for PostgreSQL 9.6 server-side programming Changes: postgresql-9.6 (9.6.13-0+deb9u1) stretch-security; urgency=medium . * New upstream version. + Prevent row-level security policies from being bypassed via selectivity estimators (Dean Rasheed) . Some of the planner's selectivity estimators apply user-defined operators to values found in pg_statistic (e.g., most-common values). A leaky operator therefore can disclose some of the entries in a data column, even if the calling user lacks permission to read that column. In CVE-2017-7484 we added restrictions to forestall that, but we failed to consider the effects of row-level security. A user who has SQL permission to read a column, but who is forbidden to see certain rows due to RLS policy, might still learn something about those rows' contents via a leaky operator. This patch further tightens the rules, allowing leaky operators to be applied to statistics data only when there is no relevant RLS policy. (CVE-2019-10130) . * Move maintainer address to tracker. Checksums-Sha1: b243dd91b746ef45b2d2360ac9aa2f7a493a7195 19078 libecpg-compat3_9.6.13-0+deb9u1_i386.deb a309567d95dccbefbb03a67b854aecf1a49ab18f 233448 libecpg-dev_9.6.13-0+deb9u1_i386.deb 79c5e77be195dd76c4684ed161e611e3f850bc48 87986 libecpg6_9.6.13-0+deb9u1_i386.deb 8ea670c4f5de610ab342b0ed35661f2a66d325b3 43036 libpgtypes3_9.6.13-0+deb9u1_i386.deb 2fd77c45f83da088233b8207e04e543dff648f65 225230 libpq-dev_9.6.13-0+deb9u1_i386.deb 11f3e6f528a1ac694d227abe60047a2e9bd51f6d 142130 libpq5_9.6.13-0+deb9u1_i386.deb f493fd345ce46d2020019b82bcfec9406e359844 14658882 postgresql-9.6-dbg_9.6.13-0+deb9u1_i386.deb 419030040aa36f0d497d69e94725a35d77fc2a19 13021 postgresql-9.6_9.6.13-0+deb9u1_i386.buildinfo 57b40aadc3a9cdb6b5fedcc52f00cab233415d30 4341292 postgresql-9.6_9.6.13-0+deb9u1_i386.deb 07fc6334eb65f113671bf3f3f60e86bd857c2afb 1270352 postgresql-client-9.6_9.6.13-0+deb9u1_i386.deb 9b2bcface00988bd5f3c6a977ab6c36517060664 532974 postgresql-contrib-9.6_9.6.13-0+deb9u1_i386.deb 6c354275ce3c356e15583fa7183155da5509ce7e 65824 postgresql-plperl-9.6_9.6.13-0+deb9u1_i386.deb 2b341736ddc8b77477637543a6fb543a3a5c2c93 56724 postgresql-plpython-9.6_9.6.13-0+deb9u1_i386.deb f1ef6a8f95d8e5cdc2402c7ef7dfba3ab90d9c36 55178 postgresql-plpython3-9.6_9.6.13-0+deb9u1_i386.deb 324103d2eac540519602132b64aab33f3e820f95 41902 postgresql-pltcl-9.6_9.6.13-0+deb9u1_i386.deb d366618c8d0bfaea34c8096fe1996b2c8085e0eb 772236 postgresql-server-dev-9.6_9.6.13-0+deb9u1_i386.deb Checksums-Sha256: b4c010ee61296dd982c3732bd33e4f6a68426f83c571addc061e226c4ab160f4 19078 libecpg-compat3_9.6.13-0+deb9u1_i386.deb 31dbfd6294ae6d733de875e3bc607d18c5d34652de5f878eb0ca0a20c43a8d64 233448 libecpg-dev_9.6.13-0+deb9u1_i386.deb b264237cc7b20c0f1ed23cac35e6112ee96dd200e7d9b26ae341c15d9a7e124f 87986 libecpg6_9.6.13-0+deb9u1_i386.deb 980c6a0ae3103e10a98250e266b70407835aa789c8f544a09c1aae4230ee9faf 43036 libpgtypes3_9.6.13-0+deb9u1_i386.deb b5b384f9f5a579da723df4b7466eaa1c8211e6b923e0a52cc2f90996f51377a0 225230 libpq-dev_9.6.13-0+deb9u1_i386.deb 7025ae95d6c6cec9e7869488544edf951b097acb18a1d992e3139a388162e38b 142130 libpq5_9.6.13-0+deb9u1_i386.deb 26c7917e9f5e5be2c24a448a5bb4bb325b169437d87d8911aaac26bbc5924e98 14658882 postgresql-9.6-dbg_9.6.13-0+deb9u1_i386.deb 3e2d851c66e8e70937bae9d8ff6606c5a96362abe5ca607ce79faecdfdc8470d 13021 postgresql-9.6_9.6.13-0+deb9u1_i386.buildinfo 55469336e4baba557697bba8f16f0b4c79a40fc0151daa8eb07632999938155a 4341292 postgresql-9.6_9.6.13-0+deb9u1_i386.deb e24f9283d441a8e7c938801e57ed41accfedf7864d85e08ce40cc184740a937d 1270352 postgresql-client-9.6_9.6.13-0+deb9u1_i386.deb 3b1f1d642acd63826256681625f95d525f66d805cb77ceefc2dd55829cb76507 532974 postgresql-contrib-9.6_9.6.13-0+deb9u1_i386.deb 715fa523d1de321693cbd3c73514a2cf12061c7de9944892ae034fc1cd38bd31 65824 postgresql-plperl-9.6_9.6.13-0+deb9u1_i386.deb 70a41a4d0d91d95bdfc558900eb45ffcccdd0b7bdb8dc7173e266b428b12cc42 56724 postgresql-plpython-9.6_9.6.13-0+deb9u1_i386.deb 227ed858dbb130ba6b676a2ec053ac563d8d80becbeb02e8e15e714e2c788ba1 55178 postgresql-plpython3-9.6_9.6.13-0+deb9u1_i386.deb 2a1a60829447f69574c1387703cb05acbe356b98a25a1a5047c280ce958503c0 41902 postgresql-pltcl-9.6_9.6.13-0+deb9u1_i386.deb ccd7168082f1f3784aded6f79d25194b7fd0fb1c4f1b0ccece4f1ab2cab9344c 772236 postgresql-server-dev-9.6_9.6.13-0+deb9u1_i386.deb Files: b2d4137f1a95f51dbba333422f6269dc 19078 libs optional libecpg-compat3_9.6.13-0+deb9u1_i386.deb 987d9f63bfc4a71bca478c3fce23d009 233448 libdevel optional libecpg-dev_9.6.13-0+deb9u1_i386.deb a6c3b700bc172b7fccfca02505e426d8 87986 libs optional libecpg6_9.6.13-0+deb9u1_i386.deb 3ae7ccdebd3d9e73de0f1e3b1fcc0197 43036 libs optional libpgtypes3_9.6.13-0+deb9u1_i386.deb b16317e25af39e006ea3431498e1d53c 225230 libdevel optional libpq-dev_9.6.13-0+deb9u1_i386.deb c8eb3639a60ba2e3a86092e41b1d84d0 142130 libs optional libpq5_9.6.13-0+deb9u1_i386.deb 3f452961845d8aca1967a5c0c5ad37d3 14658882 debug extra postgresql-9.6-dbg_9.6.13-0+deb9u1_i386.deb 31e0d0da45215cb3ca8a8eda422551d9 13021 database optional postgresql-9.6_9.6.13-0+deb9u1_i386.buildinfo 166c62490ca161e324724404c0663048 4341292 database optional postgresql-9.6_9.6.13-0+deb9u1_i386.deb dbed11237b41a6e7c7eb10c6188a3f32 1270352 database optional postgresql-client-9.6_9.6.13-0+deb9u1_i386.deb 7c328e425d5c5fbfd12657543cef2c72 532974 database optional postgresql-contrib-9.6_9.6.13-0+deb9u1_i386.deb 8a80ef742912a3991975c5218fc09daa 65824 database optional postgresql-plperl-9.6_9.6.13-0+deb9u1_i386.deb c5db552e5088892476cef86993b67f3e 56724 database optional postgresql-plpython-9.6_9.6.13-0+deb9u1_i386.deb eae75feaceefdb9d24dfd9c874d787cc 55178 database optional postgresql-plpython3-9.6_9.6.13-0+deb9u1_i386.deb 743d01cb0a78a6e9946918746f7e41f2 41902 database optional postgresql-pltcl-9.6_9.6.13-0+deb9u1_i386.deb 06acf0648230b3e0f90f73c6f2870541 772236 libdevel optional postgresql-server-dev-9.6_9.6.13-0+deb9u1_i386.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE56RkdImmGnu/qTMEtnmMmMOJfQ0FAlzRgFwACgkQtnmMmMOJ fQ3m4A//WvQ5SKbKvgXdiJ7K+P21sSS8wyXhm/1KYhYeMUmUApRTet5egwKOdvgG 29JZZc9SLRCJi7bP/Sqa/9A+I25wApfqxQraVlysw6luE+/USSd2dfN0mai9nQrR 3yYrT5SNnsa8DaK+9h5+frSye/cRcOojH/4DfFBYJZ21AqIRzOU1mzGMiZVWMcn5 YW5hqpDDTd3Nga7cRvMCzhtu+ps4WPrOBLszztMzWLHXhQJwQgqlueO6S9a/orlA ZAUJpyfpLUWIpRuhZNPYNK0H3hYkeqCbdWV1HwmszNRstN6KR6Xf9UeL+nzt5bBl tx0zHlc1uzWTEGhiMeds13Wg8bKSbZ98HJSWPbmbZq1m8LZirpuTMlDwlPErELkC 0LLfrLJ2q5ZuhqmeEfOyzP/es2vrTraBXo+lAMILAKnElnILsgXByNJU2f8fvZPu b2SppzkxU1pW/qdLRa/wgEBOzO2F88zdghxMUpOL0UFvD2XmQz0OAxCu1O3G+Shy PpVYraeDxnEl6XTTxH7siDCpAcpZryU17CCy8elyHBNEWhFUT8uy5fZSsrQjNKU9 oOMTxbzcUJoGzCbh2R2NcuTPQ8kNbdyJTcEWVuh2met+MumyxRrfQ/7d7sT1XbaJ YMfUiqSiqChH+aZuBLxhJZRE6IT3Q5bhR1rWQgTvPJRfaASN6Xg= =AuET -----END PGP SIGNATURE-----