diff --git a/postgresql-13.14.tar.bz2 b/postgresql-13.14.tar.bz2 deleted file mode 100644 index 492e789..0000000 --- a/postgresql-13.14.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:b8df078551898960bd500dc5d38a177e9905376df81fe7f2b660a1407fa6a5ed -size 21584146 diff --git a/postgresql-13.14.tar.bz2.sha256 b/postgresql-13.14.tar.bz2.sha256 deleted file mode 100644 index fc4c58b..0000000 --- a/postgresql-13.14.tar.bz2.sha256 +++ /dev/null @@ -1 +0,0 @@ -b8df078551898960bd500dc5d38a177e9905376df81fe7f2b660a1407fa6a5ed postgresql-13.14.tar.bz2 diff --git a/postgresql-13.15.tar.bz2 b/postgresql-13.15.tar.bz2 new file mode 100644 index 0000000..4b9d6a3 --- /dev/null +++ b/postgresql-13.15.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:42edd415446d33b8c242be76d1ad057531b2264b2e86939339b7075c6e4ec925 +size 21597871 diff --git a/postgresql-13.15.tar.bz2.sha256 b/postgresql-13.15.tar.bz2.sha256 new file mode 100644 index 0000000..6d6b105 --- /dev/null +++ b/postgresql-13.15.tar.bz2.sha256 @@ -0,0 +1 @@ +42edd415446d33b8c242be76d1ad057531b2264b2e86939339b7075c6e4ec925 postgresql-13.15.tar.bz2 diff --git a/postgresql13.changes b/postgresql13.changes index dcff32b..c0dcb8f 100644 --- a/postgresql13.changes +++ b/postgresql13.changes @@ -1,3 +1,28 @@ +------------------------------------------------------------------- +Thu May 9 14:08:06 UTC 2024 - Marcus Rueckert + +- Upgrade to 13.15: + CVE-2024-4317: Restrict visibility of pg_stats_ext and + pg_stats_ext_exprs entries to the table owner + + Missing authorization in PostgreSQL built-in views pg_stats_ext + and pg_stats_ext_exprs allows an unprivileged database user to + read most common values and other statistics from CREATE + STATISTICS commands of other users. The most common values may + reveal column values the eavesdropper could not otherwise read or + results of functions they cannot execute. + + This fix only fixes fresh PostgreSQL installations, namely those + that are created with the initdb utility after this fix is + applied. If you have a current PostgreSQL installation and are + concerned about this issue, please follow the instructions in the + "Updating" section on this link: + https://www.postgresql.org/about/news/postgresql-163-157-1412-1315-and-1219-released-2858/ + + The SQL file is in /usr/share/postgresql13/fix-CVE-2024-4317.sql + + https://www.postgresql.org/docs/release/13.15/ + ------------------------------------------------------------------- Wed May 1 15:24:39 UTC 2024 - Aaron Puchert diff --git a/postgresql13.spec b/postgresql13.spec index 72e7caa..156fab5 100644 --- a/postgresql13.spec +++ b/postgresql13.spec @@ -16,7 +16,7 @@ # -%define pgversion 13.14 +%define pgversion 13.15 %define pgmajor 13 %define buildlibs 0 %define tarversion %{pgversion}