The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.4, 16.8, 15.12, 14.17,
and 13.20.
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
Improve behavior of quoting functions in libpq. The fix for
CVE-2025-1094 caused the quoting functions to not honor their string
length parameters and, in some cases, cause crashes. This problem could
be noticeable from a PostgreSQL client library, based on how it is
integrated with libpq.
Fix small memory leak in pg_createsubscriber.
Also fix a problem in the FreeBSD port, where the rc script wouldn't
return properly, messing up orchestration tools like ansible. [1]
PR: 272502 [1]
Release notes: https://www.postgresql.org/docs/release/
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.3, 16.7, 15.11, 14.16,
and 13.19. This release fixes 1 security vulnerability and over 70 bugs
reported over the last several months.
For the full list of changes, please review the release notes.
This commit also removes the broken support for Heimdal and fixes the
build when using MIT Kerberos. [1]
PR: 220325 suggested by Cullum Smith and many others. [1]
Release notes: https://www.postgresql.org/docs/release/
Security: fadf3b41-ea19-11ef-a540-6cc21735f730
Upstream Python package maintainers recommend using the psycopg 3.x over
psycopg2 for new projects since the latter is in maintenance mode only.
Approved by: girgen (pgsql)
Differential Revision: https://reviews.freebsd.org/D48493
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
- Restore functionality of ALTER ROLE .. SET ROLE and ALTER DATABASE ..
SET ROLE. The fix for CVE-2024-10978 accidentally caused settings for
role to not be applied if they came from non-interactive sources,
including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS
environment variable.
- Restore compatibility for the timescaledb and other PostgreSQL
extensions built using PostgreSQL prior to the 2024-11-14 release
(17.0, 16.4, 15.8, 14.13, 13.16, 12.20, and earlier). This fix restores
struct ResultRelInfo to its previous size, so that affected extensions
don't need to be rebuilt.
- Fix cases where a logical replication slot's restart_lsn could go backwards.
- Avoid deleting still-needed WAL files during pg_rewind.
- Fix race conditions associated with dropping shared statistics
entries, which could lead to loss of statistics data.
- Fix crash with ALTER TABLE when checking to see if an index's opclass
options have changed if the table has an index with a non-default
operator class.
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.1, 16.5, 15.9, 14.14,
13.17, and 12.21. This release fixes 4 security vulnerabilities and over
35 bugs reported over the last several months.
Also add XML back as an active default option due to popular demand. [1]
Clean up the ports a bit.
PR: 269115 [1]
Release notes: https://www.postgresql.org/docs/release/
Security: a03636f4-a29f-11ef-af48-6cc21735f730
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
Security: a61ef21b-a29e-11ef-af48-6cc21735f730
Security: 3831292b-a29d-11ef-af48-6cc21735f730
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.4, 15.8, 14.13, 13.16,
and 12.20. This release fixes 1 security vulnerability and over 55 bugs
reported over the last several months.
PR: 279671 - make the rc script service jails aware
PR: 279536 - remove LLVM max version restriction
PR: 278887 - SETENV -> SETENVI for -contrib ports
Release notes: https://www.postgresql.org/docs/release/
PostgreSQL 16.3, 15.7, 14.12, 13.15, and 12.19 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.3, 15.7, 14.12, 13.15,
and 12.19. This release fixes one security vulnerability and over 55
bugs reported over the last several months.
Please note that the fix in this release for CVE-2024-4317 only fixes
fresh PostgreSQL installations, namely those that are created with the
initdb utility after this fix is applied. If you have a current
PostgreSQL installation and are concerned about this issue, please
follow the additional updating instructions provided in the
CVE-2024-4317 description or the release notes for the remediation. [1]
The script is installed as /usr/local/share/postgresql/fix-CVE-2024-4317.sql
PostgreSQL 12 will stop receiving fixes on November 14, 2024. If you are
running PostgreSQL 12 in a production environment, we suggest that you
make plans to upgrade to a newer, supported version of PostgreSQL.
Please see our versioning policy for more information.
[1]: https://www.postgresql.org/support/security/CVE-2024-4317/
Security: d53c30c1-0d7b-11ef-ba02-6cc21735f730
PR: 277428 (remove unneded patch)
PR: 260494 (remove deprecated INTDATE option)
PR: 265860 (correct path for contrib README file in pkg-message)
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.2, 15.6, 14.11, 13.14,
and 12.18. This release fixes one security vulnerability and over 65
bugs reported over the last several months.
If you use GIN indexes, you may need to reindex after updating to this
release. Please see the release notes for more information.
URL: https://www.postgresql.org/about/news/postgresql-162-156-1411-1314-and-1218-released-2807/
Release notes: https://www.postgresql.org/docs/release/
Security: 19e6dd1b-c6a5-11ee-9cd0-6cc21735f730
If postgresql_login_class is not set, honour the setting in /etc/passwd.
The previous commit ignored the passwd setting and set the login class
to "default" if it was left unset.
PR: 275851
PostgreSQL 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.1, 15.5, 14.10, 13.13,
12.17, and 11.22 This release fixes three security vulnerabilities and
over 55 bugs reported over the last several months.
Release notes: https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
Security: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870
Security: 31f45d06-7f0e-11ee-94b4-6cc21735f730
Security: 0f445859-7f0e-11ee-94b4-6cc21735f730
Security: bbb18fcb-7f0d-11ee-94b4-6cc21735f730
PostgreSQL 15.4, 14.9, 13.12, 12.16, 11.21, and PostgreSQL 16 Beta 3
Released.
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.4, 14.9, 13.12, 12.16,
and 11.21, as well as the third beta release of PostgreSQL 16. This
release fixes two security vulnerabilities and over 40 bugs reported
over the last several months.
If you use BRIN indexes to look up NULL values, you will need to reindex
them after upgrading to this release. On PostgreSQL 12 and above, you
can use REINDEX CONCURRENTLY to avoid blocking writes to the affected
index and table, for example:
REINDEX INDEX CONCURRENTLY your_index_name;
Also, remove the patch for postgresql.conf.sample suggesting to turn off
update_process_title [1], since it is no longer a problem.
Release notes: https://www.postgresql.org/about/news/postgresql-154-149-1312-1216-1121-and-postgresql-16-beta-3-released-2689/
[1]: https://commitfest.postgresql.org/19/1715/
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.3, 14.8, 13.11, 12.15,
and 11.20. This release fixes two security vulnerabilities over 80 bugs
reported over the last several months.
CVE-2023-2454: CREATE SCHEMA ... schema_element defeats protective search_path changes.
This enabled an attacker having database-level CREATE privilege to
execute arbitrary code as the bootstrap superuser. Database owners have
that right by default, and explicit grants may extend it to other users.
CVE-2023-2455: Row security policies disregard user ID changes after inlining.
While CVE-2016-2193 fixed most interaction between row security and user
ID changes, it missed a scenario involving function inlining. This leads
to potentially incorrect policies being applied in cases where
role-specific policies are used and a given query is planned under one
role and then executed under other roles. This scenario can happen under
security definer functions or when a common user and query is planned
initially and then re-used across multiple SET ROLEs. Applying an
incorrect policy may permit a user to complete otherwise-forbidden reads
and modifications. This affects only databases that have used CREATE
POLICY to define a row security policy.
Security: fbb5a260-f00f-11ed-bbae-6cc21735f730
Security: 4b636f50-f011-11ed-bbae-6cc21735f730
Release-notes: https://www.postgresql.org/docs/release/
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.2, 14.7, 13.10, 12.14,
and 11.19. This release closes one security vulnerability and fixes over
60 bugs reported over the last several months.
Release notes: https://www.postgresql.org/docs/release/
Security: CVE-2022-41862: Client memory disclosure when
connecting, with Kerberos, to modified server.
PostgreSQL server may use late-mounted filesystems, so require these
in rc.d scripts. Real life example is when /tmp is late-mounted tmpfs
atop of ZFS, and if posgresql-server starts before mountlate, its
socket which resides on /tmp is hidden under tmpfs which is mounted
afterwards.
PR: 267500
Approved by: maintainer timeout (pgsql, 2 weeks)
PostgreSQL 15.1, 14.6, 13.9, 12.13, 11.18, and 10.23 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.1, 14.6, 13.9, 12.13,
11.18, and 10.23. This release fixes 25 bugs reported over the last
several months.
This is the final release of PostgreSQL 10. PostgreSQL 10 will no longer
receive security and bug fixes. If you are running PostgreSQL 10 in a
production environment, we suggest that you make plans to upgrade.
Release notes: https://www.postgresql.org/docs/release/
Convert to ASCII and trim EOL whitespace. The scripts are now identical
across all PostgreSQL server versions we have in the ports.
Verified by: cksum(1)
Many of the WWW are overwritten later which means the wrong value
is used. This did not happen before where the children were either
a) just using the pkg-descr from the parents
b) or had their own separate pkg-descr with custom WWW
Use WWW?= in parents when the child's WWW is different.
Children that use the same WWW as the parent can just inherit it,
i.e., the child WWW can be removed.
Approved by: portmgr (implicit)
Commit b7f05445c0 has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 14.5, 13.8, 12.12, 11.17,
and 10.22, as well as the third beta release of PostgreSQL 15. This
release closes one security vulnerability and fixes over 40 bugs
reported over the last three months.
PostgreSQL 10 will stop receiving fixes on November 10, 2022. If you are
running PostgreSQL 10 in a production environment, we strongly advise
that you make plans to upgrade to a newer, supported version of
PostgreSQL so you can continue to receive bug and security fixes.
Security: CVE-2022-2625
Release notes: https://www.postgresql.org/about/news/postgresql-145-138-1212-1117-1022-and-15-beta-3-released-2496/
The rc script was converted to use a SUB_LIST variable, but I failed to
introduce the variable correctly in the Makefile. [1]
The plist for postgresql15-server was incorrect. Fixed this as well.
PR: 264097 [1]
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 14.3, 13.7, 12.11, 11.16,
and 10.21. This release fixes over 50 bugs reported over the last three
months. This release closes one security vulnerability and fixes over 50
bugs reported over the last three months.
We encourage you to install this update at your earliest possible
convenience.
If you have any GiST indexes on columns using the ltree data type, you
will need to reindex them after upgrading.
For the full list of changes, please review the release notes.
It also fixes a security issue, CVE-2022-1552:
Autovacuum, REINDEX, and others omit "security restricted operation" sandbox.
Versions Affected: 10 - 14. The security team typically does not test
unsupported versions, but this problem is quite old.
Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER,
and pg_amcheck made incomplete efforts to operate safely when a
privileged user is maintaining another user's objects. Those commands
activated relevant protections too late or not at all. An attacker
having permission to create non-temp objects in at least one schema
could execute arbitrary SQL functions under a superuser identity.
While promptly updating PostgreSQL is the best remediation for most
users, a user unable to do that can work around the vulnerability by
disabling autovacuum, not manually running the above commands, and not
restoring from output of the pg_dump command. Performance may degrade
quickly under this workaround. VACUUM is safe, and all commands are fine
when a trusted user owns the target object.
Security: 157ce083-d145-11ec-ab9b-6cc21735f730
Release notes: https://www.postgresql.org/docs/release/
This release contains a variety of fixes from the previous version.
A dump/restore is not required for those running the same major version.
However, note that installations using physical replication should
update standby servers before the primary server, as explained in the
release notes.
Also, several bugs have been found that may have resulted in corrupted
indexes, as explained in the next several changelog entries. If any of
those cases apply to you, it's recommended to reindex possibly-affected
indexes after updating.
This release also mitigates two possible man-in-the-middle attacks.
Security: 2ccd71bd-426b-11ec-87db-6cc21735f730
Release notes: https://www.postgresql.org/docs/release/14.1/
The PostgreSQL Global Development Group has released an update to all supported
versions of our database system, including 13.4, 12.8, 11.13, 10.18, and
9.6.23, as well as the third beta release of PostgreSQL 14. This release closes
one security vulnerability and fixes over 75 bugs reported over the last three
months.
Turn off parallel builds since we continue to struggle with build problems when
it is activated. [1]
Avoid chasing latest LLVM version. [2]
PR: 256466 [1], 256167 [2]
Release notes: https://www.postgresql.org/docs/release/
Security: b471130b-fb86-11eb-87db-6cc21735f730
Changeset ab83f2b4bb changed the startup order for Postgresql. The cleartmp
rc.d now comes after the Postgresql startup. Unfortunately, Postgresql likes
to create a socket in /tmp/.s.PGSQL.5432. After cleartmp does its work, that
socket disappears from the filesystem.
Submitted by: Jeroen Pulles
PR: 256335
Release notes: https://www.postgresql.org/docs/devel/release-14.html
Also reintroduce parallel builds. Some components, namely plperl,
plpython, pltcl and contrib, fail to build properly when using parallel
builds. Something with static linking using `ar` that fails.
MAKE_JOBS_UNSAFE is set for these ports.
PostgreSQL 13.3, 12.7, 11.12, 10.17, and 9.6.22 Released!
The PostgreSQL Global Development Group has released an update to all supported
versions of our database system, including 13.3, 12.7, 11.12, 10.17, and
9.6.22. This release closes three security vulnerabilities and fixes over 45
bugs reported over the last three months.
Security fixes in this release:
CVE-2021-32027: Buffer overrun from integer overflow in array subscripting
calculations
CVE-2021-32028: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE
CVE-2021-32029: Memory disclosure in partitioned-table UPDATE ... RETURNING
Also plenty of bug fixes. See the release note for details.
Changes to the port:
Make sure we use the matching version of llvm. This fixes a problem with the
llvm version string not being monotonically increasing with the version
number. [1]
Better pkg message about checksums for postgresql 12+. [2] [4]
Adjust login class parameter to adhere to the documentation in rc.subr(8) [3]:
The rc.conf parameter for the login class of the postgresql daemon has
changed name from postgresql_class to postgresql_login_class, since
rc.subr(8) states that the parameter should be named ${name}_login_class.
Allow parallel builds. [5]
Correct the directory name for the user postgres in pkg message. [6]
PR: 250824 [1], 253558 [2], 236060 [3], 233106 [4], 230656 [5]
PR: 226674 [6]
Submitted by: Michael Zhilin [2], Michael Zhilin [3], Dmitry Chestnykh [4]
Submitted by: Steve Wills [5], knezour [6]
Security: 76e0bb86-b4cb-11eb-b9c9-6cc21735f730
Security: 62da9702-b4cc-11eb-b9c9-6cc21735f730
Release notes: https://www.postgresql.org/docs/release/
