New upstream microreleases 12.17, 14.10, and 15.5

[Bryce Harrington]

[Impact]

 * MRE for latest stable fixes of Postgres 12, 14, and 15 released on November 2023.

[Test Case]

 * The Postgres MREs traditionally rely on the large set of autopkgtests
   to run for verification. In a PPA, those are all already pre-checked to
   be good for this upload.

[Regression Potential]

 * Upstream tests are usually great and in addition in the Archive there
   are plenty of autopkgtests that in the past caught issues before being
   released.
   But nevertheless there always is a risk for something to break. Since
   these are general stable releases I can't pinpoint them to a most-likely area.
   - usually this works smoothly except a few test hiccups (flaky) that need to be clarified to be sure. Pre-checks will catch those to be discussed upfront (as last time)

[Other Info]

 * This is a reoccurring MRE, see below and all the references
 * CVEs addressed by this MRE:
  - CVE-2023-5868
  - CVE-2023-5869
  - CVE-2023-5870

Current versions in supported releases that got updates:
 postgresql-12 | 12.16-0ubuntu0.20.04.1 | focal-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-14 | 14.9-0ubuntu0.22.04.1 | jammy-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-15 | 15.4-0ubuntu0.23.04.1 | lunar-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-15 | 15.4-1ubuntu1 | mantic | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Special cases:
- we will not perform a postgresql-15 update for noble since it is transitioning to postgresql-16.
- Since there are 3 CVEs being fixed here, we will likely push this through the security pocket.

Standing MRE - Consider last updates as template:
- pad.lv/1637236
- pad.lv/1664478
- pad.lv/1690730
- pad.lv/1713979
- pad.lv/1730661
- pad.lv/1747676
- pad.lv/1752271
- pad.lv/1786938
- pad.lv/1815665
- pad.lv/1828012
- pad.lv/1833211
- pad.lv/1839058
- pad.lv/1863108
- pad.lv/1892335
- pad.lv/1915254
- pad.lv/1928773
- pad.lv/1939396
- pad.lv/1950268
- pad.lv/1961127
- pad.lv/1973627
- pad.lv/1978249
- pad.lv/1984012
- pad.lv/1996770
- pad.lv/2006406
- pad.lv/2019214
- pad.lv/2028426

As usual we test and prep from the PPA and then push through SRU/Security as applicable.

Once ready, the test packages should be available at https://launchpad.net/~canonical-server/+archive/ubuntu/postgresql-sru-preparation/+packages

[Athos Ribeiro (athos-ribeiro)]

I am marking the postgresql-15 noble task to invalid since we are transitioning it to postgresql-16 ATM.

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-14 - 14.10-0ubuntu0.22.04.1

---------------
postgresql-14 (14.10-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * New upstream version (LP: #2040469).

    + A dump/restore is not required for those running 14.X.

    + However, several mistakes have been discovered that could lead to
      certain types of indexes yielding wrong search results or being
      unnecessarily inefficient. It is advisable to REINDEX
      potentially-affected indexes after installing this update.

    + Also, if you are upgrading from a version earlier than 14.9, see
      those release notes as well please.

    + Fix handling of unknown-type arguments in DISTINCT "any" aggregate
      functions (Tom Lane)

      This error led to a text-type value being interpreted as an unknown-type
      value (that is, a zero-terminated string) at runtime. This could result
      in disclosure of server memory following the text value.
      (CVE-2023-5868)

    + Detect integer overflow while computing new array dimensions
      (Tom Lane)

      When assigning new elements to array subscripts that are outside the
      current array bounds, an undetected integer overflow could occur in edge
      cases. Memory stomps that are potentially exploitable for arbitrary code
      execution are possible, and so is disclosure of server memory.
      (CVE-2023-5869)

    + Prevent the <literal>pg_signal_backend</literal> role from
      signalling background workers and autovacuum processes (Noah Misch,
      Jelte Fennema-Nio)

      The documentation says that pg_signal_backend cannot issue signals to
      superuser-owned processes. It was able to signal these background
      processes, though, because they advertise a role OID of zero. Treat that
      as indicating superuser ownership. The security implications of
      cancelling one of these process types are fairly small so far as the
      core code goes (we'll just start another one), but extensions might add
      background workers that are more vulnerable.

      Also ensure that the is_superuser parameter is set correctly in such
      processes. No specific security consequences are known for that
      oversight, but it might be significant for some extensions.
      (CVE-2023-5870)

    + Fix misbehavior during recursive page split in GiST index build
      (Heikki Linnakangas)

      Fix a case where the location of a page downlink was incorrectly
      tracked, and introduce some logic to allow recovering from such
      situations rather than silently doing the wrong thing. This error
      could result in incorrect answers from subsequent index searches.
      It may be advisable to reindex all GiST indexes after installing
      this update.

    + Prevent de-duplication of btree index entries for interval columns
      (Noah Misch)

      There are interval values that are distinguishable but compare
      equal, for example "24:00:00" and "1 day". This breaks assumptions
      made by btree de-duplication, so interval columns need to be excluded
      from de-duplication. This oversight can cause incorrect results from
      index-only scans. Moreover,...

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-15 - 15.5-0ubuntu0.23.04.1

---------------
postgresql-15 (15.5-0ubuntu0.23.04.1) lunar-security; urgency=medium

  * New upstream version (LP: #2040469).

    + A dump/restore is not required for those running 15.X.

    + However, several mistakes have been discovered that could lead to
      certain types of indexes yielding wrong search results or being
      unnecessarily inefficient. It is advisable to REINDEX
      potentially-affected indexes after installing this update.

    + Also, if you are upgrading from a version earlier than 15.4, see
      those release notes as well please.

    + Fix handling of unknown-type arguments in DISTINCT "any" aggregate
      functions (Tom Lane)

      This error led to a text-type value being interpreted as an unknown-type
      value (that is, a zero-terminated string) at runtime. This could result
      in disclosure of server memory following the text value.
      (CVE-2023-5868)

    + Detect integer overflow while computing new array dimensions (Tom Lane)

      When assigning new elements to array subscripts that are outside the
      current array bounds, an undetected integer overflow could occur in edge
      cases. Memory stomps that are potentially exploitable for arbitrary code
      execution are possible, and so is disclosure of server memory.
      (CVE-2023-5869)

    + Prevent the pg_signal_backend role from signalling background workers
      and autovacuum processes (Noah Misch, Jelte Fennema-Nio)

      The documentation says that pg_signal_backend cannot issue signals to
      superuser-owned processes. It was able to signal these background
      processes, though, because they advertise a role OID of zero. Treat that
      as indicating superuser ownership. The security implications of
      cancelling one of these process types are fairly small so far as the
      core code goes (we'll just start another one), but extensions might add
      background workers that are more vulnerable.

      Also ensure that the is_superuser parameter is set correctly in such
      processes. No specific security consequences are known for that
      oversight, but it might be significant for some extensions.
      (CVE-2023-5870)

    + Fix misbehavior during recursive page split in GiST index build
      (Heikki Linnakangas)

      Fix a case where the location of a page downlink was incorrectly
      tracked, and introduce some logic to allow recovering from such
      situations rather than silently doing the wrong thing. This error could
      result in incorrect answers from subsequent index searches. It may be
      advisable to reindex all GiST indexes after installing this update.

    + Prevent de-duplication of btree index entries for interval columns
      (Noah Misch)

      There are interval values that are distinguishable but compare equal,
      for example 24:00:00 and 1 day. This breaks assumptions made by btree
      de-duplication, so interval columns need to be excluded from
      de-duplication. This oversight can cause incorrect results from
      index-only scans. Moreover, after updating amcheck will report an error
   ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-12 - 12.17-0ubuntu0.20.04.1

---------------
postgresql-12 (12.17-0ubuntu0.20.04.1) focal-security; urgency=medium

  * New upstream version (LP: #2040469).

    + A dump/restore is not required for those running 12.X.

    + However, if you use GiST indexes, it may be advisable to reindex them.

    + Also, if you are upgrading from a version earlier than 12.16, see
      those release notes as well please.

    + Fix handling of unknown-type arguments in DISTINCT "any" aggregate
      functions (Tom Lane)

      This error led to a text-type value being interpreted as an unknown-type
      value (that is, a zero-terminated string) at runtime. This could result
      in disclosure of server memory following the text value.
      (CVE-2023-5868)

    + Detect integer overflow while computing new array dimensions
      (Tom Lane)

      When assigning new elements to array subscripts that are outside the
      current array bounds, an undetected integer overflow could occur in edge
      cases. Memory stomps that are potentially exploitable for arbitrary code
      execution are possible, and so is disclosure of server memory.
      (CVE-2023-5869)

    + Prevent the <literal>pg_signal_backend</literal> role from
      signalling background workers and autovacuum processes (Noah Misch,
      Jelte Fennema-Nio)

      The documentation says that pg_signal_backend cannot issue signals to
      superuser-owned processes. It was able to signal these background
      processes, though, because they advertise a role OID of zero. Treat that
      as indicating superuser ownership. The security implications of
      cancelling one of these process types are fairly small so far as the
      core code goes (we'll just start another one), but extensions might add
      background workers that are more vulnerable.

      Also ensure that the is_superuser parameter is set correctly in such
      processes. No specific security consequences are known for that
      oversight, but it might be significant for some extensions.
      (CVE-2023-5870)

    + Fix misbehavior during recursive page split in GiST index build
      (Heikki Linnakangas)

      Fix a case where the location of a page downlink was incorrectly
      tracked, and introduce some logic to allow recovering from such
      situations rather than silently doing the wrong thing. This error
      could result in incorrect answers from subsequent index searches.
      It may be advisable to reindex all GiST indexes after installing
      this update.

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/12/release-12-17.html.

  * d/p/libpgport-pkglibdir: Adjust patch to reflect upstream changes.

  * d/p/50-per-version-dirs.patch: Adjust TestLib.pm's
    scan_server_header and check_pg_config to account for
    unrelocatability of pg_config.
    These changes are needed because, during build time,
    we want to be able to run the upstream tests using the pg_config
    binary from inside the "debian/" directory, but that doesn't work out
    of the box because it will print includedir paths that als...

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-15 - 15.5-0ubuntu0.23.10.1

---------------
postgresql-15 (15.5-0ubuntu0.23.10.1) mantic-security; urgency=medium

  * New upstream version (LP: #2040469).

    + A dump/restore is not required for those running 15.X.

    + However, several mistakes have been discovered that could lead to
      certain types of indexes yielding wrong search results or being
      unnecessarily inefficient. It is advisable to REINDEX
      potentially-affected indexes after installing this update.

    + Also, if you are upgrading from a version earlier than 15.4, see
      those release notes as well please.

    + Fix handling of unknown-type arguments in DISTINCT "any" aggregate
      functions (Tom Lane)

      This error led to a text-type value being interpreted as an unknown-type
      value (that is, a zero-terminated string) at runtime. This could result
      in disclosure of server memory following the text value.
      (CVE-2023-5868)

    + Detect integer overflow while computing new array dimensions (Tom Lane)

      When assigning new elements to array subscripts that are outside the
      current array bounds, an undetected integer overflow could occur in edge
      cases. Memory stomps that are potentially exploitable for arbitrary code
      execution are possible, and so is disclosure of server memory.
      (CVE-2023-5869)

    + Prevent the pg_signal_backend role from signalling background workers
      and autovacuum processes (Noah Misch, Jelte Fennema-Nio)

      The documentation says that pg_signal_backend cannot issue signals to
      superuser-owned processes. It was able to signal these background
      processes, though, because they advertise a role OID of zero. Treat that
      as indicating superuser ownership. The security implications of
      cancelling one of these process types are fairly small so far as the
      core code goes (we'll just start another one), but extensions might add
      background workers that are more vulnerable.

      Also ensure that the is_superuser parameter is set correctly in such
      processes. No specific security consequences are known for that
      oversight, but it might be significant for some extensions.
      (CVE-2023-5870)

    + Fix misbehavior during recursive page split in GiST index build
      (Heikki Linnakangas)

      Fix a case where the location of a page downlink was incorrectly
      tracked, and introduce some logic to allow recovering from such
      situations rather than silently doing the wrong thing. This error could
      result in incorrect answers from subsequent index searches. It may be
      advisable to reindex all GiST indexes after installing this update.

    + Prevent de-duplication of btree index entries for interval columns
      (Noah Misch)

      There are interval values that are distinguishable but compare equal,
      for example 24:00:00 and 1 day. This breaks assumptions made by btree
      de-duplication, so interval columns need to be excluded from
      de-duplication. This oversight can cause incorrect results from
      index-only scans. Moreover, after updating amcheck will report an error
  ...