-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 07 Aug 2024 16:09:15 +0200 Source: postgresql-13 Architecture: source Version: 13.16-0+deb11u1 Distribution: bullseye-security Urgency: medium Maintainer: Debian PostgreSQL Maintainers Changed-By: Christoph Berg Changes: postgresql-13 (13.16-0+deb11u1) bullseye-security; urgency=medium . * New upstream version. . + Prevent unauthorized code execution during pg_dump (Masahiko Sawada) . An attacker able to create and drop non-temporary objects could inject SQL code that would be executed by a concurrent pg_dump session with the privileges of the role running pg_dump (which is often a superuser). The attack involves replacing a sequence or similar object with a view or foreign table that will execute malicious code. To prevent this, introduce a new server parameter restrict_nonsystem_relation_kind that can disable expansion of non-builtin views as well as access to foreign tables, and teach pg_dump to set it when available. Note that the attack is prevented only if both pg_dump and the server it is dumping from are new enough to have this fix. . The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2024-7348) Checksums-Sha1: 32d573b94e33fbffbe8e1820d1ce38fd1eaf40e9 3703 postgresql-13_13.16-0+deb11u1.dsc a2465d5086abb2b2ff9115541cae404f869dfa0f 21639411 postgresql-13_13.16.orig.tar.bz2 e8bdc30531b4382becf4d20965fa7e5d4255751b 35060 postgresql-13_13.16-0+deb11u1.debian.tar.xz Checksums-Sha256: c1c95c213760880a6b86a38b95c27cc0559fc9db98955579eb95b7176ac9dc2e 3703 postgresql-13_13.16-0+deb11u1.dsc c9cbbb6129f02328204828066bb3785c00a85c8ca8fd329c2a8a53c1f5cd8865 21639411 postgresql-13_13.16.orig.tar.bz2 8c68c86c19f783c4ea8ade14c56998c5843d4fbde004e4253604652a0d55efdf 35060 postgresql-13_13.16-0+deb11u1.debian.tar.xz Files: 74bf5b7191a6e2604dff8989deadd2ae 3703 database optional postgresql-13_13.16-0+deb11u1.dsc 111a4b3e1a91aeb72097a9bfa4b3b7dc 21639411 database optional postgresql-13_13.16.orig.tar.bz2 d4b09448f03432189260e18a50326f79 35060 database optional postgresql-13_13.16-0+deb11u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAma00o4ACgkQTFprqxLS p66ryQ//RAvWUTrHxFhKSdr04GWEpqbs21HA+iPU1pmMnAVQaXsK4UB8NFb7JToc 3ov3s64OcT4YALRCze5v++PznZBssJTsxfOyLQPKK5OQF7LdZtQdLbvl6tGMLyob acRt+gghNPrNU0n1N+2P/xb6ReqwyCXNlu/q4uFghczE5xUsRAy98zRtZx/lO4wV u+MPuyyeVb6RlQtjZy+evhHef6I7l91c9pyueVR/bRkeNqsXVmQSYMk+asa/+B4y cl/n3vtZq+VShr2Dpn6u2XCq3uVsdj5HhRq8562w/LgvnUZMq7gjhi7cpUIhH7Ra hT7TK36xK8fm2sHAqsF7A5Pu3YZjbFsjQoiN98KZCnPVuLc8MCGE3IKkPWkIglQ0 xajRtU0N4u2bXVLiv8PvysYL1dDKm2yZcOBRxuwBEkSH7zWpqJxC9ez2LxpvU2Fu ZEYn9EvJ5QaskF+HsYjSlhxUsjDuuSG1G04lPRiPbNDg7ATVwORXAvUGkJgSngKS lO404kKDFF7Z2PI3HonMY/RXr/Q7N7QAbf1okO7WIvEOmxqd0LPG640C01t8cB0/ se4fs0wymVSFqrk9O+1JQjlu0+xKCfVLGEYofUSO5fEJ26P1K0IqD7oDhMjn01KR MgE1NJptitvHBXi/qqskXruhcuuYbG7jAc7xIY7z+I9/50ih/Ws= =A1Fm -----END PGP SIGNATURE-----