New upstream microreleases 10.22, 12.12 and 14.5

Bug #1984012 reported by Sergio Durigan Junior
20
This bug affects 2 people
Affects Status Importance Assigned to Milestone
postgresql-10 (Ubuntu)
Invalid
Undecided
Unassigned
Bionic
Fix Released
High
Athos Ribeiro
postgresql-12 (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
High
Athos Ribeiro
postgresql-14 (Ubuntu)
Fix Released
Undecided
Unassigned
Jammy
Fix Released
High
Sergio Durigan Junior

Bug Description

[Impact]

 * MRE for latest stable fixes of Postgres 10, 12 and 14 released on August 2022.

[Test Case]

 * The Postgres MREs traditionally rely on the large set of autopkgtests
   to run for verification. In a PPA those are all already pre-checked to
   be good for this upload.

[Regression Potential]

 * Upstreams tests are usually great and in additon in the Archive there
   are plenty of autopkgtests that in the past catched issues before being
   released.
   But nevertheless there always is a risk for something to break. Since
   these are general stable releases I can't pinpoint them to a most-likely area.
   - usually this works smoothly except a few test hickups (flaky) that need to be clarified to be sure. Pre-checks will catch those to be discussed upfront (as last time)

[Other Info]

 * This is a reoccurring MRE, see below and all the references
 * CVEs this time:
   - CVE-2022-2625

Current versions in supported releases that got updates:
 postgresql-10 | 10.21-0ubuntu0.18.04.1 | bionic-updates | source, amd64, arm64, armhf, i386, ppc64el, s390x
 postgresql-12 | 12.11-0ubuntu0.20.04.1 | focal-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-14 | 14.4-0ubuntu0.22.04.1 | jammy-updates | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Special cases:
- Kinetic has already synced from Debian as usual (14.5).

Standing MRE - Consider last updates as template:
- pad.lv/1637236
- pad.lv/1664478
- pad.lv/1690730
- pad.lv/1713979
- pad.lv/1730661
- pad.lv/1747676
- pad.lv/1752271
- pad.lv/1786938
- pad.lv/1815665
- pad.lv/1828012
- pad.lv/1833211
- pad.lv/1839058
- pad.lv/1863108
- pad.lv/1892335
- pad.lv/1915254
- pad.lv/1928773
- pad.lv/1939396
- pad.lv/1950268
- pad.lv/1961127
- pad.lv/1973627
- pad.lv/1978249

As usual we test and prep from the PPA and then push through SRU/Security as applicable.

Related branches

CVE References

no longer affects: postgresql-10 (Ubuntu Focal)
no longer affects: postgresql-10 (Ubuntu Jammy)
no longer affects: postgresql-12 (Ubuntu Bionic)
no longer affects: postgresql-12 (Ubuntu Jammy)
no longer affects: postgresql-14 (Ubuntu Bionic)
no longer affects: postgresql-14 (Ubuntu Focal)
Changed in postgresql-10 (Ubuntu):
status: New → Invalid
Changed in postgresql-12 (Ubuntu):
status: New → Invalid
Changed in postgresql-10 (Ubuntu Bionic):
status: New → In Progress
Changed in postgresql-12 (Ubuntu Focal):
status: New → In Progress
Changed in postgresql-14 (Ubuntu Jammy):
status: New → In Progress
Changed in postgresql-10 (Ubuntu Bionic):
importance: Undecided → High
Changed in postgresql-12 (Ubuntu Focal):
importance: Undecided → High
Changed in postgresql-14 (Ubuntu Jammy):
importance: Undecided → High
assignee: nobody → Sergio Durigan Junior (sergiodj)
Changed in postgresql-10 (Ubuntu Bionic):
status: In Progress → New
Changed in postgresql-12 (Ubuntu Focal):
status: In Progress → New
tags: added: server-todo
Changed in postgresql-12 (Ubuntu Focal):
assignee: nobody → Athos Ribeiro (athos-ribeiro)
Changed in postgresql-10 (Ubuntu Bionic):
assignee: nobody → Athos Ribeiro (athos-ribeiro)
description: updated
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in postgresql-10 (Ubuntu Bionic):
status: New → Confirmed
Changed in postgresql-12 (Ubuntu Focal):
status: New → Confirmed
Changed in postgresql-14 (Ubuntu):
status: New → Confirmed
tags: added: needs-mre-backport
Changed in postgresql-12 (Ubuntu Focal):
status: Confirmed → In Progress
Changed in postgresql-10 (Ubuntu Bionic):
status: Confirmed → In Progress
Revision history for this message
Sergio Durigan Junior (sergiodj) wrote :

The new postgresql-{10,12} (targeting Bionic and Focal, respectively) are causing regressions on two packages: pgq and pgq-node.

Athos and I have investigated the problem and found upstream fixes for both. Please refer to bug #1986714 for more details.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-10 - 10.22-0ubuntu0.18.04.1

---------------
postgresql-10 (10.22-0ubuntu0.18.04.1) bionic-security; urgency=medium

  * New upstream version (LP: #1984012).

    + A dump/restore is not required for those running 10.X.

    + Also, if you are upgrading from a version earlier than 10.19, see
      those release notes as well please.

    + Do not let extension scripts replace objects not already belonging
      to the extension (Tom Lane).
      (CVE-2022-2625)

    + Fix permissions checks in CREATE INDEX (Nathan Bossart,
      Noah Misch).

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/10/release-10-22.html

 -- Athos Ribeiro <email address hidden> Thu, 11 Aug 2022 16:54:48 -0300

Changed in postgresql-10 (Ubuntu Bionic):
status: In Progress → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-12 - 12.12-0ubuntu0.20.04.1

---------------
postgresql-12 (12.12-0ubuntu0.20.04.1) focal-security; urgency=medium

  * New upstream version (LP: #1984012).

    + A dump/restore is not required for those running 12.X.

    + Also, if you are upgrading from a version earlier than 12.10, see
      those release notes as well please.

    + Do not let extension scripts replace objects not already belonging
      to the extension (Tom Lane).
      (CVE-2022-2625)

    + Fix permissions checks in CREATE INDEX (Nathan Bossart,
      Noah Misch).

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/12/release-12-12.html

 -- Athos Ribeiro <email address hidden> Thu, 11 Aug 2022 16:54:40 -0300

Changed in postgresql-12 (Ubuntu Focal):
status: In Progress → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-14 - 14.5-0ubuntu0.22.04.1

---------------
postgresql-14 (14.5-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * New upstream version (LP: #1984012).

    + A dump/restore is not required for those running 14.X.

    + Also, if you are upgrading from a version earlier than 14.4, see
      those release notes as well please.

    + Do not let extension scripts replace objects not already belonging
      to the extension (Tom Lane).
      (CVE-2022-2625)

    + Do not let extension scripts replace objects not already belonging
      to the extension (Tom Lane).

    + Fix permissions checks in CREATE INDEX (Nathan Bossart,
      Noah Misch).

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/14/release-14-5.html

 -- Sergio Durigan Junior <email address hidden> Mon, 08 Aug 2022 18:15:57 -0400

Changed in postgresql-14 (Ubuntu Jammy):
status: In Progress → Fix Released
Changed in postgresql-14 (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.