New upstream microreleases 12.16, 14.9, and 15.4

[Bryce Harrington]

[Impact]

 * MRE for latest stable fixes of Postgres 12, 14, and 15 released on August 2023.

[Test Case]

 * The Postgres MREs traditionally rely on the large set of autopkgtests
   to run for verification. In a PPA those are all already pre-checked to
   be good for this upload.

[Regression Potential]

 * Upstreams tests are usually great and in additon in the Archive there
   are plenty of autopkgtests that in the past caught issues before being
   released.
   But nevertheless there always is a risk for something to break. Since
   these are general stable releases I can't pinpoint them to a most-likely area.
   - usually this works smoothly except a few test hickups (flaky) that need to be clarified to be sure. Pre-checks will catch those to be discussed upfront (as last time)

[Other Info]

 * This is a reoccurring MRE, see below and all the references
 * CVEs addressed by this MRE:
  - CVE-2023-39417
  - CVE-2023-39418 (lunar only)

Current versions in supported releases that got updates:
 postgresql-12 | 12.15-0ubuntu0.20.04.1 | focal-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-14 | 14.8-0ubuntu0.22.04.1 | jammy-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-15 | 15.3-0ubuntu0.23.04.1 | lunar-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Special cases:
- mantic will sync from debian as usual, once it us published in debian unstable.

Standing MRE - Consider last updates as template:
- pad.lv/1637236
- pad.lv/1664478
- pad.lv/1690730
- pad.lv/1713979
- pad.lv/1730661
- pad.lv/1747676
- pad.lv/1752271
- pad.lv/1786938
- pad.lv/1815665
- pad.lv/1828012
- pad.lv/1833211
- pad.lv/1839058
- pad.lv/1863108
- pad.lv/1892335
- pad.lv/1915254
- pad.lv/1928773
- pad.lv/1939396
- pad.lv/1950268
- pad.lv/1961127
- pad.lv/1973627
- pad.lv/1978249
- pad.lv/1984012
- pad.lv/1996770
- pad.lv/2006406
- pad.lv/2019214

As usual we test and prep from the PPA and then push through SRU/Security as applicable.

Once ready, the test packages should be available at https://launchpad.net/~canonical-server/+archive/ubuntu/postgresql-sru-preparation/+packages

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Athos Ribeiro (athos-ribeiro)]

The lunar MRE (and the mantic update) is blocked on LP: #2030684 (tzdata bug)

[Athos Ribeiro (athos-ribeiro)]

LP: #2029498 is also relevant for the mantic update (FTBFS due to llvm-16 incompatibilities).

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-12 - 12.16-0ubuntu0.20.04.1

---------------
postgresql-12 (12.16-0ubuntu0.20.04.1) focal-security; urgency=medium

  * New upstream version (LP: #2028426).

    + A dump/restore is not required for those running 12.X.

    + However, if you use BRIN indexes, it may be advisable to reindex them.

    + Also, if you are upgrading from a version earlier than 12.10, see
      those release notes as well please.

    + Disallow substituting a schema or owner name into an extension script
      if the name contains a quote, backslash, or dollar sign (Noah Misch)

      This restriction guards against SQL-injection hazards for trusted
      extensions.
      (CVE-2023-39417)

    + Fix confusion between empty (no rows) ranges and all-NULL ranges in
      BRIN indexes, as well as incorrect merging of all-NULL summaries
      (Tomas Vondra)

      Each of these oversights could result in forgetting that a BRIN
      index range contains any NULL values, potentially allowing
      subsequent queries that should return NULL values to miss doing so.

      This fix will not in itself correct faulty BRIN entries.
      It's recommended to REINDEX any BRIN indexes that
      may be used to search for nulls.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/12/release-12-16.html.

 -- Sergio Durigan Junior <email address hidden> Thu, 11 May 2023 15:58:10 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-15 - 15.4-0ubuntu0.23.04.1

---------------
postgresql-15 (15.4-0ubuntu0.23.04.1) lunar-security; urgency=medium

  * New upstream version (LP: #2028426).

    + A dump/restore is not required for those running 15.X.

    + However, if you use BRIN indexes, it may be advisable to reindex them.

    + Also, if you are upgrading from a version earlier than 15.1, see
      those release notes as well please.

    + Disallow substituting a schema or owner name into an extension script
      if the name contains a quote, backslash, or dollar sign (Noah Misch)

      This restriction guards against SQL-injection hazards for trusted
      extensions.
      (CVE-2023-39417)

    + Fix MERGE to enforce row security policies properly (Dean Rasheed)
      (CVE-2023-39418)

    + Fix confusion between empty (no rows) ranges and all-NULL ranges in
      BRIN indexes, as well as incorrect merging of all-NULL summaries
      (Tomas Vondra)

      Each of these oversights could result in forgetting that a BRIN
      index range contains any NULL values, potentially allowing
      subsequent queries that should return NULL values to miss doing so.

      This fix will not in itself correct faulty BRIN entries.
      It's recommended to REINDEX any BRIN indexes that
      may be used to search for nulls.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/15/release-15-4.html.

 -- Athos Ribeiro <email address hidden> Wed, 09 Aug 2023 09:00:47 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-14 - 14.9-0ubuntu0.22.04.1

---------------
postgresql-14 (14.9-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * New upstream version (LP: #2028426).

    + A dump/restore is not required for those running 14.X.

    + However, if you use BRIN indexes, it may be advisable to reindex them.

    + Also, if you are upgrading from a version earlier than 14.4, see
      those release notes as well please.

    + Disallow substituting a schema or owner name into an extension script
      if the name contains a quote, backslash, or dollar sign (Noah Misch)

      This restriction guards against SQL-injection hazards for trusted
      extensions.
      (CVE-2023-39417)

    + Fix confusion between empty (no rows) ranges and all-NULL ranges in
      BRIN indexes, as well as incorrect merging of all-NULL summaries
      (Tomas Vondra)

      Each of these oversights could result in forgetting that a BRIN
      index range contains any NULL values, potentially allowing
      subsequent queries that should return NULL values to miss doing so.

      This fix will not in itself correct faulty BRIN entries.
      It's recommended to REINDEX any BRIN indexes that
      may be used to search for nulls.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/14/release-14-9.html

 -- Athos Ribeiro <email address hidden> Wed, 09 Aug 2023 09:01:25 -0300