New upstream microreleases 12.20, 14.13, and 16.4

[Athos Ribeiro]

[Impact]

 * MRE for latest stable fixes of Postgres 12, 14, and 16 released on August 2024.

[Test Case]

 * The Postgres MREs traditionally rely on the large set of autopkgtests
   to run for verification. In a PPA, those are all already pre-checked to
   be good for this upload.

[Regression Potential]

 * Upstream tests are usually great and in addition in the Archive there
   are plenty of autopkgtests that in the past caught issues before being
   released.
   But nevertheless there always is a risk for something to break. Since
   these are general stable releases I can't pinpoint them to a most-likely area.
   - usually this works smoothly except a few test hiccups (flaky) that need to be clarified to be sure. Pre-checks will catch those to be discussed upfront (as last time)

[Other Info]

 * This is a reoccurring MRE, see below and all the references
 * CVEs addressed by this MRE:
  - CVE-2024-7348

Current versions in supported releases that got updates:

 postgresql-12 | 12.19-0ubuntu0.20.04.1 | focal-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-14 | 14.12-0ubuntu0.22.04.1 | jammy-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-16 | 16.3-0ubuntu0.24.04.1 | noble-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Special cases:
- Since there is 1 CVE being fixed here, we will push these MREs through the security pocket.
- Oracular will sync from Debian

Standing MRE - Consider last updates as template:

- https://pad.lv/1637236
- https://pad.lv/1664478
- https://pad.lv/1690730
- https://pad.lv/1713979
- https://pad.lv/1730661
- https://pad.lv/1747676
- https://pad.lv/1752271
- https://pad.lv/1786938
- https://pad.lv/1815665
- https://pad.lv/1828012
- https://pad.lv/1833211
- https://pad.lv/1839058
- https://pad.lv/1863108
- https://pad.lv/1892335
- https://pad.lv/1915254
- https://pad.lv/1928773
- https://pad.lv/1939396
- https://pad.lv/1950268
- https://pad.lv/1961127
- https://pad.lv/1973627
- https://pad.lv/1978249
- https://pad.lv/1984012
- https://pad.lv/1996770
- https://pad.lv/2006406
- https://pad.lv/2019214
- https://pad.lv/2028426
- https://pad.lv/2040469
- https://pad.lv/2067388

As usual we test and prep from the PPA and then push through SRU/Security as applicable.

Once ready, the test packages should be available at https://launchpad.net/~canonical-server/+archive/ubuntu/postgresql-sru-preparation/+packages

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-12 - 12.20-0ubuntu0.20.04.1

---------------
postgresql-12 (12.20-0ubuntu0.20.04.1) focal-security; urgency=medium

  * New upstream version (LP: #2076183).

    + A dump/restore is not required for those running 12.X.

    + However, if you are upgrading from a version earlier than 12.18, see
      those release notes as well please.

    + Prevent unauthorized code execution during pg_dump (Masahiko Sawada)

      An attacker able to create and drop non-temporary objects could inject
      SQL code that would be executed by a concurrent pg_dump session with the
      privileges of the role running pg_dump (which is often a superuser).
      The attack involves replacing a sequence or similar object with a view
      or foreign table that will execute malicious code. To prevent this,
      introduce a new server parameter restrict_nonsystem_relation_kind that
      can disable expansion of non-builtin views as well as access to foreign
      tables, and teach pg_dump to set it when available. Note that the
      attack is prevented only if both pg_dump and the server it is dumping
      from are new enough to have this fix.

      The PostgreSQL Project thanks Noah Misch for reporting this problem.
      (CVE-2024-7348)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/12/release-12-20.html.

  * d/postgresql-12.NEWS: Update.

 -- Athos Ribeiro <email address hidden> Tue, 06 Aug 2024 15:15:12 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-14 - 14.13-0ubuntu0.22.04.1

---------------
postgresql-14 (14.13-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * New upstream version (LP: #2076183).

    + A dump/restore is not required for those running 14.X.

    + However, if you are upgrading from a version earlier than 14.12, see
      those release notes as well please.

    + Prevent unauthorized code execution during pg_dump (Masahiko Sawada)

      An attacker able to create and drop non-temporary objects could inject
      SQL code that would be executed by a concurrent pg_dump session with the
      privileges of the role running pg_dump (which is often a superuser).
      The attack involves replacing a sequence or similar object with a view
      or foreign table that will execute malicious code. To prevent this,
      introduce a new server parameter restrict_nonsystem_relation_kind that
      can disable expansion of non-builtin views as well as access to foreign
      tables, and teach pg_dump to set it when available. Note that the
      attack is prevented only if both pg_dump and the server it is dumping
      from are new enough to have this fix.

      The PostgreSQL Project thanks Noah Misch for reporting this problem.
      (CVE-2024-7348)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/14/release-14-13.html.

  * d/postgresql-14.NEWS: Update.
  * d/p/focal-arm64-outline-atomics: refresh patch.

 -- Athos Ribeiro <email address hidden> Tue, 06 Aug 2024 15:14:44 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-16 - 16.4-0ubuntu0.24.04.1

---------------
postgresql-16 (16.4-0ubuntu0.24.04.1) noble-security; urgency=medium

  * New upstream version (LP: #2076183).

    + A dump/restore is not required for those running 16.X.

    + However, if you are upgrading from a version earlier than 16.3, see
      those release notes as well please.

    + Prevent unauthorized code execution during pg_dump (Masahiko Sawada)

      An attacker able to create and drop non-temporary objects could inject
      SQL code that would be executed by a concurrent pg_dump session with the
      privileges of the role running pg_dump (which is often a superuser).
      The attack involves replacing a sequence or similar object with a view
      or foreign table that will execute malicious code. To prevent this,
      introduce a new server parameter restrict_nonsystem_relation_kind that
      can disable expansion of non-builtin views as well as access to foreign
      tables, and teach pg_dump to set it when available. Note that the
      attack is prevented only if both pg_dump and the server it is dumping
      from are new enough to have this fix.

      The PostgreSQL Project thanks Noah Misch for reporting this problem.
      (CVE-2024-7348)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/16/release-16-4.html.

  * d/postgresql-16.NEWS: Update.

 -- Athos Ribeiro <email address hidden> Tue, 06 Aug 2024 15:13:57 -0300