postgresqlNN: updated to 14.3, 13.7, 12.11, 11.16, and 10.21

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 14.3, 13.7, 12.11, 11.16, and 10.21. This release closes one security vulnerability and fixes over 50 bugs reported over the last three months.

CVE-2022-1552: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox.

Versions Affected: 10 - 14. The security team typically does not test unsupported versions, but this problem is quite old.

Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck made incomplete efforts to operate safely when a privileged user is maintaining another user's objects. Those commands activated relevant protections too late or not at all. An attacker having permission to create non-temp objects in at least one schema could execute arbitrary SQL functions under a superuser identity.

While promptly updating PostgreSQL is the best remediation for most users, a user unable to do that can work around the vulnerability by disabling autovacuum, not manually running the above commands, and not restoring from output of the pg_dump command. Performance may degrade quickly under this workaround. VACUUM is safe, and all commands are fine when a trusted user owns the target object.


Bug Fixes and Improvements

This update fixes over 50 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 14. Some of these issues may also affect other supported versions of PostgreSQL.

Included in this release:

Fix issue that could lead to corruption of GiST indexes on ltree columns. After upgrading, you will need to reindex any GiST indexes on ltree columns.
Column names in tuples produced by a whole-row variable (e.g. tbl.*) outside of a top-level of a SELECT list are now always associated with those of the associated named composite type, if there is one. The release notes detail a workaround if you depend on the previous behavior.
Fix incorrect rounding when extracting epoch values from interval types.
Prevent issues with calling pg_stat_get_replication_slot(NULL).
Fix incorrect output for types timestamptz and timetz in table_to_xmlschema().
Fix errors related to a planner issue that affected asynchronous remote queries.
Fix planner failure if a query using SEARCH or CYCLE features contains a duplicate common-table expression (WITH) name.
Fix ALTER FUNCTION to support changing a function's parallelism property and its SET-variable list in the same command.
Fix incorrect sorting of table rows when using CLUSTER on an index whose leading key is an expression.
Prevent data loss if a system crash occurs shortly after a sorted GiST index build.
Fix risk of deadlock failures while dropping a partitioned index.
Fix race condition between DROP TABLESPACE and checkpointing that could fail to remove all dead files from the tablespace directory.
Fix potential issue in crash recovery after a TRUNCATE command that overlaps with a checkpoint.
Re-allow _ as the first character in a custom configuration parameter name.
Fix PANIC: xlog flush request is not satisfied failure during standby promotion when there is a missing WAL continuation record.
Fix possibility of self-deadlock in hot standby conflict handling.
Ensure that logical replication apply workers can be restarted when the server is near the max_sync_workers_per_subscription limit.
Disallow execution of SPI functions during PL/Perl function compilation.
libpq now accepts root-owned SSL private key files, which matches the rules the server has used since the 9.6 release.
Re-allow database.schema.table patterns in psql, pg_dump, and pg_amcheck.
Several fixes for pageinspect to improve overall stability.
Disable batch insertion in postgres_fdw when BEFORE INSERT ... FOR EACH ROW triggers exist on the foreign table.
Update JIT code to work with LLVM 14.

3 files changed, 7 insertions, 8 deletions

diff --git a/databases/postgresql14/Makefile b/databases/postgresql14/Makefile
index 31ea3bf790e..720630b494f 100644
--- a/databases/postgresql14/Makefile
+++ b/databases/postgresql14/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.7 2022/05/12 13:03:57 abs Exp $
+# $NetBSD: Makefile,v 1.8 2022/05/12 19:02:46 adam Exp $
 
 PKGNAME=	${DISTNAME:S/-/14-/}
-PKGREVISION=	2
 COMMENT=	Robust, next generation, object-relational DBMS
 
 DEPENDS+=	postgresql14-client>=${PKGVERSION_NOREV}:../../databases/postgresql14-client
diff --git a/databases/postgresql14/Makefile.common b/databases/postgresql14/Makefile.common
index 4242920176b..b882d4268b8 100644
--- a/databases/postgresql14/Makefile.common
+++ b/databases/postgresql14/Makefile.common
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.3 2022/02/11 08:31:24 adam Exp $
+# $NetBSD: Makefile.common,v 1.4 2022/05/12 19:02:46 adam Exp $
 #
 # This Makefile fragment is included by all PostgreSQL packages built from
 # the main sources of the PostgreSQL distribution except jdbc-postgresql.
@@ -16,7 +16,7 @@
 # used by databases/postgresql14-pltcl/Makefile
 # used by databases/postgresql14-server/Makefile
 
-DISTNAME=	postgresql-14.2
+DISTNAME=	postgresql-14.3
 CATEGORIES=	databases
 MASTER_SITES=	${MASTER_SITE_PGSQL:=source/v${PKGVERSION_NOREV}/}
 EXTRACT_SUFX=	.tar.bz2
diff --git a/databases/postgresql14/distinfo b/databases/postgresql14/distinfo
index 9b883933259..f5bbb942618 100644
--- a/databases/postgresql14/distinfo
+++ b/databases/postgresql14/distinfo
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.5 2022/02/11 08:31:24 adam Exp $
+$NetBSD: distinfo,v 1.6 2022/05/12 19:02:46 adam Exp $
 
-BLAKE2s (postgresql-14.2.tar.bz2) = 065346daa76b51cabcb161b800f5dbd44399525598868e8e0cafb431f4e2650e
-SHA512 (postgresql-14.2.tar.bz2) = 19aeb6528605dbcf5df84048b2eed8f54b202576134d3fe3900bb8f073179c4258d2581acd745887e7e6fa86ebdb5f7b159ffaa0a645d601efee7c5f7730456b
-Size (postgresql-14.2.tar.bz2) = 21964841 bytes
+BLAKE2s (postgresql-14.3.tar.bz2) = 70e8f4efa10e09ac9904b039c977a868ff5a3472453925faa7971d49fc9f4ae0
+SHA512 (postgresql-14.3.tar.bz2) = 70e6f67b5729a23f80b92b04e3fad2e09596b939660e3ddebf499d06af946459a45a019279e05413673e7b65d09a28a0440ed3c2ae565068466ed37e2d4f6f17
+Size (postgresql-14.3.tar.bz2) = 22092190 bytes
 SHA1 (patch-config_missing) = c2d7d742922ba6861e7660c75b7b53f09e564813
 SHA1 (patch-config_perl.m4) = b3393d0f28e97f89ae20297d85553c508b3896bb
 SHA1 (patch-configure) = 142ba9dc85a2408802e4b9e4943b775312d577c9