New PostgreSQL upstream microreleases 14.20, 16.11, and 17.7

[Lena Voytek]

[Impact]

 * MRE for latest stable fixes of Postgres 14, 16, and 17 released in November 2025.

[Test Case]

 * The Postgres MREs traditionally rely on the large set of autopkgtests
   to run for verification. In a PPA, those are all already pre-checked to
   be good for this upload.

[Regression Potential]

 * Upstream tests are usually great and in addition in the Archive there
   are plenty of autopkgtests that in the past caught issues before being
   released.
   But nevertheless there always is a risk for something to break. Since
   these are general stable releases I can't pinpoint them to a most-likely area.
   - usually this works smoothly except a few test hiccups (flaky) that need to be clarified to be sure. Pre-checks will catch those to be discussed upfront (as last time)

[Other Info]

 * This is a reoccurring MRE, see below and all the references
 * CVEs addressed by this MRE:
  - CVE-2025-12817
  - CVE-2025-12818

Current versions in supported releases that got updates:

 postgresql-14 | 14.19-0ubuntu0.22.04.1 | jammy-security | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-16 | 16.10-0ubuntu0.24.04.1 | noble-security | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-17 | 17.6-0ubuntu0.25.04.1 | plucky-security | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-17 | 17.6-1build1 | questing | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Special cases:
- Since there are 2 CVEs being fixed here, we will push these MREs through the security pocket.
- resolute is transitioning to postgresql-18, which contains those fixes as well. Therefore, we will not update posrgresql-17 there.

Standing MRE - Consider last updates as template:

- https://pad.lv/1637236
- https://pad.lv/1664478
- https://pad.lv/1690730
- https://pad.lv/1713979
- https://pad.lv/1730661
- https://pad.lv/1747676
- https://pad.lv/1752271
- https://pad.lv/1786938
- https://pad.lv/1815665
- https://pad.lv/1828012
- https://pad.lv/1833211
- https://pad.lv/1839058
- https://pad.lv/1863108
- https://pad.lv/1892335
- https://pad.lv/1915254
- https://pad.lv/1928773
- https://pad.lv/1939396
- https://pad.lv/1950268
- https://pad.lv/1961127
- https://pad.lv/1973627
- https://pad.lv/1978249
- https://pad.lv/1984012
- https://pad.lv/1996770
- https://pad.lv/2006406
- https://pad.lv/2019214
- https://pad.lv/2028426
- https://pad.lv/2040469
- https://pad.lv/2067388
- https://pad.lv/2076183
- https://pad.lv/2085196
- https://pad.lv/2099900
- https://pad.lv/2110377
- https://pad.lv/2112531

As usual we test and prep from the PPA and then push through SRU/Security as applicable.

Once ready, the test packages should be available at https://launchpad.net/~canonical-server/+archive/ubuntu/postgresql-sru-preparation/+packages

[Athos Ribeiro (athos)]

The packages are now available in the PPA (https://launchpad.net/~canonical-server/+archive/ubuntu/postgresql-sru-preparation) for testing.

[Athos Ribeiro (athos)]

The relevant tests are passing. This is ready to be released in the security pocket

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-14 - 14.20-0ubuntu0.22.04.1

---------------
postgresql-14 (14.20-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * New upstream version (LP: #2127667).

    + A dump/restore is not required for those running 14.X.

    + However, if you are upgrading from a version earlier than 14.19, see
      those release notes as well please.

    + Check for CREATE privileges on the schema in CREATE STATISTICS (Jelte
      Fennema-Nio)

      This omission allowed table owners to create statistics in any schema,
      potentially leading to unexpected naming conflicts. (CVE-2025-12817)

    + Avoid integer overflow in allocation-size calculations within libpq
      (Jacob Champion)

      Several places in libpq were not sufficiently careful about computing
      the required size of a memory allocation. Sufficiently large inputs
      could cause integer overflow, resulting in an undersized buffer, which
      would then lead to writing past the end of the buffer. (CVE-2025-12818)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/14/release-14-20.html.

  * d/postgresql-14.NEWS: Update NEWS file.

 -- Athos Ribeiro <email address hidden> Mon, 24 Nov 2025 10:34:10 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-16 - 16.11-0ubuntu0.24.04.1

---------------
postgresql-16 (16.11-0ubuntu0.24.04.1) noble-security; urgency=medium

  * New upstream version (LP: #2127667).

    + A dump/restore is not required for those running 16.X.

    + However, if you are upgrading from a version earlier than 16.10, see
      those release notes as well please.

    + Check for CREATE privileges on the schema in CREATE STATISTICS (Jelte
      Fennema-Nio)

      This omission allowed table owners to create statistics in any schema,
      potentially leading to unexpected naming conflicts. (CVE-2025-12817)

    + Avoid integer overflow in allocation-size calculations within libpq
      (Jacob Champion)

      Several places in libpq were not sufficiently careful about computing
      the required size of a memory allocation. Sufficiently large inputs
      could cause integer overflow, resulting in an undersized buffer, which
      would then lead to writing past the end of the buffer. (CVE-2025-12818)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/16/release-16-11.html.

  * d/postgresql-16.NEWS: Update NEWS file.

 -- Athos Ribeiro <email address hidden> Mon, 24 Nov 2025 09:58:56 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-17 - 17.7-0ubuntu0.25.10.1

---------------
postgresql-17 (17.7-0ubuntu0.25.10.1) questing-security; urgency=medium

  * New upstream version (LP: #2127667).

    + A dump/restore is not required for those running 17.X.

    + However, if you are upgrading from a version earlier than 17.6, see
      those release notes as well please.

    + Check for CREATE privileges on the schema in CREATE STATISTICS (Jelte
      Fennema-Nio)

      This omission allowed table owners to create statistics in any schema,
      potentially leading to unexpected naming conflicts. (CVE-2025-12817)

    + Avoid integer overflow in allocation-size calculations within libpq
      (Jacob Champion)

      Several places in libpq were not sufficiently careful about computing
      the required size of a memory allocation. Sufficiently large inputs
      could cause integer overflow, resulting in an undersized buffer, which
      would then lead to writing past the end of the buffer. (CVE-2025-12818)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/17/release-17-7.html.

  * d/postgresql-17.NEWS: Create NEWS file.

 -- Athos Ribeiro <email address hidden> Wed, 19 Nov 2025 10:23:51 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package postgresql-17 - 17.7-0ubuntu0.25.04.1

---------------
postgresql-17 (17.7-0ubuntu0.25.04.1) plucky-security; urgency=medium

  * New upstream version (LP: #2127667).

    + A dump/restore is not required for those running 17.X.

    + However, if you are upgrading from a version earlier than 17.6, see
      those release notes as well please.

    + Check for CREATE privileges on the schema in CREATE STATISTICS (Jelte
      Fennema-Nio)

      This omission allowed table owners to create statistics in any schema,
      potentially leading to unexpected naming conflicts. (CVE-2025-12817)

    + Avoid integer overflow in allocation-size calculations within libpq
      (Jacob Champion)

      Several places in libpq were not sufficiently careful about computing
      the required size of a memory allocation. Sufficiently large inputs
      could cause integer overflow, resulting in an undersized buffer, which
      would then lead to writing past the end of the buffer. (CVE-2025-12818)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/17/release-17-7.html.

  * d/postgresql-17.NEWS: Update NEWS file.

 -- Athos Ribeiro <email address hidden> Wed, 19 Nov 2025 14:54:01 -0300