-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 06 Feb 2024 13:37:19 +0100 Source: postgresql-15 Binary: postgresql-doc-15 Architecture: all Version: 15.6-0+deb12u1 Distribution: bookworm-security Urgency: medium Maintainer: all Build Daemon (x86-csail-02) Changed-By: Christoph Berg Description: postgresql-doc-15 - documentation for the PostgreSQL database management system Changes: postgresql-15 (15.6-0+deb12u1) bookworm-security; urgency=medium . * New upstream version. . * Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (Heikki Linnakangas) . One step of a concurrent refresh command was run under weak security restrictions. If a materialized view's owner could persuade a superuser or other high-privileged user to perform a concurrent refresh on that view, the view's owner could control code executed with the privileges of the user running REFRESH. Fix things so that all user-determined code is run as the view's owner, as expected. . The PostgreSQL Project thanks Pedro Gallegos for reporting this problem. (CVE-2024-0985) Checksums-Sha1: fc450aae8c6226fa0d09f6d65e5a8d13cb0d2a72 10233 postgresql-15_15.6-0+deb12u1_all-buildd.buildinfo b4e5d3499c21ac6b70048cda71aa6e71ab0763f4 2033312 postgresql-doc-15_15.6-0+deb12u1_all.deb Checksums-Sha256: 34e2517daa39f37304c411283f592e30118ca2c2e2b84646d8a825c9097fbcf9 10233 postgresql-15_15.6-0+deb12u1_all-buildd.buildinfo 4e5702f2c749fbf37b08a57c8a8eee75288d0b59304c44325c029ab55e365bb3 2033312 postgresql-doc-15_15.6-0+deb12u1_all.deb Files: db384eab511e18ace2b762d6e657035a 10233 database optional postgresql-15_15.6-0+deb12u1_all-buildd.buildinfo 72018f600aa0a2a5030d218da1f1ca86 2033312 doc optional postgresql-doc-15_15.6-0+deb12u1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtzb3SVunlrB0F8t8ExOkVqF4GXMFAmXMttEACgkQExOkVqF4 GXPxHQ//VOIQMDZhAagZlnssVwWJ3KxPHLCwNYYFY74Qhnmp/A00ASZWoxjHmHqY PIdhN0A00FtRICQCXBJkM67mk5xC0BLHbCMHBo5l8g15CTxxWkJZyQVOm3InUj8v Jk1zRr1K7Vp4Ac18IFo2LeROlp7PCkd4rMTpzXpgckVVqoXTqoqCxaD3ENgTM9Hq lLZyJC0iwhfIXNG0qiJO76EF7X9dXYeYF607ZogIiV3q0YAX/oUI40A/dvJMlpDe VratCw7X3t9DfbNz0f8po3EurmCi47xc6w4qFCQ6HubrSfYa43qb2ijiQGljaj1L qaJtH7wN7QhEjUGLiDC3JVyqyCnHFfSSMCOvnXcDZarrJPdyT9b/XH11lQEMoVVb yoXrA7lEBB4/GAKhpJOW50UAMXvPcsLY0v8ChyPAw2BoEOzENWI1xRoKW8GavLdX pZ/SE6Fk2OlBh3kAzXAhZjoRwBIiM4k8CKh+L7gzJQo7do+pjmwVM4hqXFLi/P/Z TfKNDMP0rj+G25iG3P7tMkk3kSDXQRz0ArS6K7rFBHdFVX5xTguFuzdOnHYyWkIM EDf9TGZaRXoYvGH/uFj9r8eWnuZDTLouqJTH9I/M1F0U06ynXDtKWNGe4aXwVCGY njJvYNRFRaAWUGe908jDAZQ8DXvd2PBzEbqd4OM9PlhLHjcD6g0= =7qIy -----END PGP SIGNATURE-----