Package Release Info

postgresql14-14.5-150200.5.17.1

Update Info: SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-2989
Available in Package Hub : 15 SP4 Subpackages Updates

platforms

AArch64
ppc64le
s390x
x86-64

subpackages

postgresql14-llvmjit
postgresql14-test

Change Logs

* Fri Aug 12 2022 max@suse.com
-  Update to 14.5:
  * bsc#1202368, CVE-2022-2625: Extension scripts replace objects
    not belonging to the extension.
  * https://www.postgresql.org/docs/release/14.5/
* Fri Jun 17 2022 max@suse.com
- bsc#1200437: Upgrade to 14.4:
  * Prevent possible corruption of indexes created or rebuilt with
    the CONCURRENTLY option.
  * https://www.postgresql.org/docs/release/14.4/
  * https://www.postgresql.org/about/news/p-2470/
* Wed Apr 13 2022 max@suse.com
- bsc#1198166: Pin to llvm13 until the next patchlevel update.
Version: 14.10-150200.5.36.1
* Wed Nov 08 2023 max@suse.com
- Update to 14.10:
  * bsc#1216962, CVE-2023-5868: Fix handling of unknown-type
    arguments in DISTINCT "any" aggregate functions. This error led
    to a text-type value being interpreted as an unknown-type value
    (that is, a zero-terminated string) at runtime. This could
    result in disclosure of server memory following the text value.
  * bsc#1216961, CVE-2023-5869: Detect integer overflow while
    computing new array dimensions. When assigning new elements to
    array subscripts that are outside the current array bounds, an
    undetected integer overflow could occur in edge cases. Memory
    stomps that are potentially exploitable for arbitrary code
    execution are possible, and so is disclosure of server memory.
  * bsc#1216960, CVE-2023-5870: Prevent the pg_signal_backend role
    from signalling background workers and autovacuum processes.
    The documentation says that pg_signal_backend cannot issue
    signals to superuser-owned processes. It was able to signal
    these background  processes, though, because they advertise a
    role OID of zero. Treat that as indicating superuser ownership.
    The security implications of cancelling one of these process
    types are fairly small so far as the core code goes (we'll just
    start another one), but extensions might add background workers
    that are more vulnerable.
    Also ensure that the is_superuser parameter is set correctly in
    such processes. No specific security consequences are known for
    that oversight, but it might be significant for some extensions.
  * Add support for LLVM 16 and 17
  * https://www.postgresql.org/docs/14/release-14-10.html
* Tue Oct 31 2023 max@suse.com
- boo#1216734: Revert the last change and make the devel package
  independend of all other subpackages except for the libs.
* Tue Oct 10 2023 max@suse.com
- boo#1216022: Call install-alternatives from the devel subpackage
  as well, otherwise the symlink for ecpg might be missing.
* Mon Sep 18 2023 dimstar@opensuse.org
- Also buildignore the postgresql*-implementation symbols: this is
  needed in order to bootstrap when no postgresql version currently
  has valid symbols provided. Once the packages are built, OBS
  could translate this to the pgname-* packages and accept the
  ignores; during bootstrap though, there is nothing providing the
  symbol and the existing buildignores do not suffice.
* Fri May 26 2023 max@suse.com
- Restore the independence of mini builds from the main build after
  the -mini name change from April 4, 2023.
- Adjust icu handling to prepare for PostgreSQL 16.
* Mon May 15 2023 max@suse.com
- Overhaul postgresql-README.SUSE and move it from the binary
  package to the noarch wrapper package.
- Change the unix domain socket location from /var/run to /run.
Version: 14.3-150200.5.12.2
* Thu May 12 2022 max@suse.com
- Upgrade to 14.3:
  * bsc#1199475, CVE-2022-1552: Confine additional operations
    within "security restricted operation" sandboxes.
  * https://www.postgresql.org/docs/14/release-14-3.html
Version: 14.2-5.9.2
* Tue Feb 08 2022 max@suse.com
- bsc#1195680: Upgrade to 14.2:
  * https://www.postgresql.org/docs/14/release-14-2.html
  * Reindexing might be needed after applying this upgrade, so
    please read the release notes carefully.
* Sat Dec 11 2021 ada.lovelace@gmx.de
- boo#1190740: Add constraints file with 12GB of memory for s390x
  as a workaround
* Thu Nov 25 2021 max@suse.com
- Add a llvmjit-devel subpackage to pull in the right versions
  of clang and llvm for building extensions.
- Fix some mistakes in the interdependencies between the
  implementation packages and their noarch counterpart.
- Update the BuildIgnore section.
Version: 14.1-5.6.1
* Wed Nov 10 2021 max@suse.com
- bsc#1192516: Upgrade to 14.1
  * Make the server reject extraneous data after an SSL or GSS
    encryption handshake (CVE-2021-23214).
  * Make libpq reject extraneous data after an SSL or GSS
    encryption handshake (CVE-2021-23222).
  * https://www.postgresql.org/docs/14/release-14-1.html
* Wed Oct 20 2021 max@suse.com
- boo#1191782: Let rpmlint ignore shlib-policy-name-error.
Version: 14.0-5.3.1
* Tue Oct 05 2021 max@suse.com
- Remove postgresql-testsuite-int8.sql.patch, because its purpose
  is unclear. This affects only the test subpackage.
* Thu Sep 30 2021 mrueckert@suse.de
- Upgrade to 14.0
  https://www.postgresql.org/about/news/postgresql-14-released-2318/
  https://www.postgresql.org/docs/14/release-14.html
* Mon Sep 27 2021 max@suse.com
- Let genlists skip non-existing binaries to avoid lots of version
  conditionals in the file lists.
* Sat Sep 25 2021 mrueckert@suse.de
- Upgrade to 14~rc1
  https://www.postgresql.org/about/news/postgresql-14-rc-1-released-2309/
  https://www.postgresql.org/docs/14/release-14.html
  https://wiki.postgresql.org/wiki/PostgreSQL_14_Open_Items
* Fri Jun 25 2021 mrueckert@suse.de
- Upgrade to 14~beta2
  https://www.postgresql.org/about/news/postgresql-14-beta-2-released-2249/
  https://www.postgresql.org/docs/14/release-14.html
  https://wiki.postgresql.org/wiki/PostgreSQL_14_Open_Items
* Fri May 21 2021 mrueckert@suse.de
- Upgrade to 14~beta1
  https://www.postgresql.org/about/news/postgresql-14-beta-1-released-2213/
  https://www.postgresql.org/docs/14/release-14.html
  https://wiki.postgresql.org/wiki/PostgreSQL_14_Open_Items
- disable postgresql-testsuite-int8.sql.patch:
  it seems it is not needed anymore, need to be double checked.
* Wed May 19 2021 max@suse.com
- bsc#1185952: llvm12 breaks PostgreSQL 11 and 12 on s390x.
  Use llvm11 as a workaround.
* Tue May 11 2021 max@suse.com
- Upgrade to version 13.3:
  * https://www.postgresql.org/docs/13/release-13-3.html
  * CVE-2021-32027, bsc#1185924:
    Prevent integer overflows in array subscripting calculations.
  * CVE-2021-32028, bsc#1185925: Fix mishandling of ?junk?
    columns in INSERT ... ON CONFLICT ... UPDATE target lists.
  * CVE-2021-32029, bsc#1185926: Fix possibly-incorrect
    computation of UPDATE ... RETURNING
    "pg_psql_temporary_savepoint" does not exist?.
- Don't use %_stop_on_removal, because it was meant to be private
  and got removed from openSUSE. %_restart_on_update is also
  private, but still supported and needed for now (bsc#1183168).
* Mon Mar 15 2021 max@suse.com
- Re-enable build of the llvmjit subpackage on SLE, but it will
  only be delivered on PackageHub for now (boo#1183118).
* Tue Mar 09 2021 max@suse.com
- Remove leftover PreReq on chkconfig, we stopped using it long
  time ago.
* Fri Feb 19 2021 max@suse.com
- boo#1179945: Disable icu for PostgreSQL 10 (and older) on TW.
* Wed Feb 10 2021 max@suse.com
- Upgrade to version 13.2:
  * https://www.postgresql.org/docs/13/release-13-2.html
  * Updating stored views and reindexing might be needed after
    applying this update.
  * CVE-2021-3393, bsc#1182040: Fix information leakage in
    constraint-violation error messages.
  * CVE-2021-20229, bsc#1182039: Fix failure to check per-column
    SELECT privileges in some join queries.
  * Obsoletes postgresql-icu68.patch.
* Mon Dec 14 2020 gmbr3@opensuse.org
- Add postgresql-icu68.patch: fix build with ICU 68
* Fri Nov 20 2020 max@suse.com
- bsc#1178961: %ghost the symlinks to pg_config and ecpg.
- boo#1179765: BuildRequire libpq5 and libecpg6 when not building
  them to avoid dangling symlinks in the devel package.
* Wed Nov 11 2020 max@suse.com
- Upgrade to version 13.1:
  * CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD
    and firing of deferred triggers within index expressions and
    materialized view queries.
  * CVE-2020-25694, bsc#1178667:
    a) Fix usage of complex connection-string parameters in pg_dump,
    pg_restore, clusterdb, reindexdb, and vacuumdb.
    b) When psql's \connect command re-uses connection parameters,
    ensure that all non-overridden parameters from a previous
    connection string are re-used.
  * CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from
    modifying specially-treated variables.
  * Fix recently-added timetz test case so it works when the USA
    is not observing daylight savings time.
    (obsoletes postgresql-timetz.patch)
  * https://www.postgresql.org/about/news/2111/
  * https://www.postgresql.org/docs/13/release-13-1.html
* Tue Nov 03 2020 max@suse.com
- Fix a DST problem in the test suite: postgresql-timetz.patch
  https://postgr.es/m/16689-57701daa23b377bf@postgresql.org
* Fri Sep 25 2020 max@suse.com
- Initial packaging of PostgreSQL 13:
  * https://www.postgresql.org/about/news/2077/
  * https://www.postgresql.org/docs/13/release-13.html