New upstream microreleases 9.1.9, 8.4.17

I cannot add a hardy task to 8.3, so I'll misuse the raring task for the 8.3/hardy update.

I will sync -9.1 into raring from Debian unstable.

Vulnerability overview:

     - Fix insecure parsing of server command-line switches.
       A connection request containing a database name that begins with
       "-" could be crafted to damage or destroy files within the server's
       data directory, even if the request is eventually rejected.
       [CVE-2013-1899]

       Critical, affects 9.1 only.

     - Reset OpenSSL randomness state in each postmaster child process.
       This avoids a scenario wherein random numbers generated by
       "contrib/pgcrypto" functions might be relatively easy for another
       database user to guess. The risk is only significant when the
       postmaster is configured with ssl = on but most connections don't
       use SSL encryption. [CVE-2013-1900]

       Moderate, affects all versions

     - Make REPLICATION privilege checks test current user not
       authenticated user.
       An unprivileged database user could exploit this mistake to call
       pg_start_backup() or pg_stop_backup(), thus possibly interfering
       with creation of routine backups. [CVE-2013-1901]

       Moderate, affects 9.1 only

This bug was fixed in the package postgresql-8.4 - 8.4.17-0ubuntu10.04

---------------
postgresql-8.4 (8.4.17-0ubuntu10.04) lucid-security; urgency=low

  * New upstream security/bug fix release: (LP: #1163184)
    - Reset OpenSSL randomness state in each postmaster child process.
      This avoids a scenario wherein random numbers generated by
      "contrib/pgcrypto" functions might be relatively easy for another
      database user to guess. The risk is only significant when the
      postmaster is configured with ssl = on but most connections don't
      use SSL encryption. [CVE-2013-1900]
    - Fix GiST indexes to not use "fuzzy" geometric comparisons when it's
      not appropriate to do so.
      The core geometric types perform comparisons using "fuzzy"
      equality, but gist_box_same must do exact comparisons, else GiST
      indexes using it might become inconsistent. After installing this
      update, users should "REINDEX" any GiST indexes on box, polygon,
      circle, or point columns, since all of these use gist_box_same.
    - Fix erroneous range-union and penalty logic in GiST indexes that
      use "contrib/btree_gist" for variable-width data types, that is
      text, bytea, bit, and numeric columns.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      useless index bloat. Users are advised to "REINDEX" such indexes
      after installing this update.
    - Fix bugs in GiST page splitting code for multi-column indexes.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      indexes that are unnecessarily inefficient to search. Users are
      advised to "REINDEX" multi-column GiST indexes after installing
      this update.
    - See HISTORY/changelog.gz for the other bug fixes.
 -- Martin Pitt <email address hidden> Tue, 02 Apr 2013 12:31:54 +0200

This bug was fixed in the package postgresql-9.1 - 9.1.9-0ubuntu11.10

---------------
postgresql-9.1 (9.1.9-0ubuntu11.10) oneiric-security; urgency=low

  * New upstream security/bug fix release: (LP: #1163184)
    - Fix insecure parsing of server command-line switches.
      A connection request containing a database name that begins with
      "-" could be crafted to damage or destroy files within the server's
      data directory, even if the request is eventually rejected.
      [CVE-2013-1899]
    - Reset OpenSSL randomness state in each postmaster child process.
      This avoids a scenario wherein random numbers generated by
      "contrib/pgcrypto" functions might be relatively easy for another
      database user to guess. The risk is only significant when the
      postmaster is configured with ssl = on but most connections don't
      use SSL encryption. [CVE-2013-1900]
    - Make REPLICATION privilege checks test current user not
      authenticated user.
      An unprivileged database user could exploit this mistake to call
      pg_start_backup() or pg_stop_backup(), thus possibly interfering
      with creation of routine backups. [CVE-2013-1901]
    - Fix GiST indexes to not use "fuzzy" geometric comparisons when it's
      not appropriate to do so.
      The core geometric types perform comparisons using "fuzzy"
      equality, but gist_box_same must do exact comparisons, else GiST
      indexes using it might become inconsistent. After installing this
      update, users should "REINDEX" any GiST indexes on box, polygon,
      circle, or point columns, since all of these use gist_box_same.
    - Fix erroneous range-union and penalty logic in GiST indexes that
      use "contrib/btree_gist" for variable-width data types, that is
      text, bytea, bit, and numeric columns.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      useless index bloat. Users are advised to "REINDEX" such indexes
      after installing this update.
    - Fix bugs in GiST page splitting code for multi-column indexes.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      indexes that are unnecessarily inefficient to search. Users are
      advised to "REINDEX" multi-column GiST indexes after installing
      this update.
    - See HISTORY/changelog.gz for details about the other bug fixes.
 -- Martin Pitt <email address hidden> Tue, 02 Apr 2013 12:24:32 +0200

This bug was fixed in the package postgresql-9.1 - 9.1.9-0ubuntu12.04

---------------
postgresql-9.1 (9.1.9-0ubuntu12.04) precise-security; urgency=low

  * New upstream security/bug fix release: (LP: #1163184)
    - Fix insecure parsing of server command-line switches.
      A connection request containing a database name that begins with
      "-" could be crafted to damage or destroy files within the server's
      data directory, even if the request is eventually rejected.
      [CVE-2013-1899]
    - Reset OpenSSL randomness state in each postmaster child process.
      This avoids a scenario wherein random numbers generated by
      "contrib/pgcrypto" functions might be relatively easy for another
      database user to guess. The risk is only significant when the
      postmaster is configured with ssl = on but most connections don't
      use SSL encryption. [CVE-2013-1900]
    - Make REPLICATION privilege checks test current user not
      authenticated user.
      An unprivileged database user could exploit this mistake to call
      pg_start_backup() or pg_stop_backup(), thus possibly interfering
      with creation of routine backups. [CVE-2013-1901]
    - Fix GiST indexes to not use "fuzzy" geometric comparisons when it's
      not appropriate to do so.
      The core geometric types perform comparisons using "fuzzy"
      equality, but gist_box_same must do exact comparisons, else GiST
      indexes using it might become inconsistent. After installing this
      update, users should "REINDEX" any GiST indexes on box, polygon,
      circle, or point columns, since all of these use gist_box_same.
    - Fix erroneous range-union and penalty logic in GiST indexes that
      use "contrib/btree_gist" for variable-width data types, that is
      text, bytea, bit, and numeric columns.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      useless index bloat. Users are advised to "REINDEX" such indexes
      after installing this update.
    - Fix bugs in GiST page splitting code for multi-column indexes.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      indexes that are unnecessarily inefficient to search. Users are
      advised to "REINDEX" multi-column GiST indexes after installing
      this update.
    - See HISTORY/changelog.gz for details about the other bug fixes.
 -- Martin Pitt <email address hidden> Tue, 02 Apr 2013 11:59:41 +0200

This bug was fixed in the package postgresql-9.1 - 9.1.9-0ubuntu12.10

---------------
postgresql-9.1 (9.1.9-0ubuntu12.10) quantal-security; urgency=low

  * New upstream security/bug fix release: (LP: #1163184)
    - Fix insecure parsing of server command-line switches.
      A connection request containing a database name that begins with
      "-" could be crafted to damage or destroy files within the server's
      data directory, even if the request is eventually rejected.
      [CVE-2013-1899]
    - Reset OpenSSL randomness state in each postmaster child process.
      This avoids a scenario wherein random numbers generated by
      "contrib/pgcrypto" functions might be relatively easy for another
      database user to guess. The risk is only significant when the
      postmaster is configured with ssl = on but most connections don't
      use SSL encryption. [CVE-2013-1900]
    - Make REPLICATION privilege checks test current user not
      authenticated user.
      An unprivileged database user could exploit this mistake to call
      pg_start_backup() or pg_stop_backup(), thus possibly interfering
      with creation of routine backups. [CVE-2013-1901]
    - Fix GiST indexes to not use "fuzzy" geometric comparisons when it's
      not appropriate to do so.
      The core geometric types perform comparisons using "fuzzy"
      equality, but gist_box_same must do exact comparisons, else GiST
      indexes using it might become inconsistent. After installing this
      update, users should "REINDEX" any GiST indexes on box, polygon,
      circle, or point columns, since all of these use gist_box_same.
    - Fix erroneous range-union and penalty logic in GiST indexes that
      use "contrib/btree_gist" for variable-width data types, that is
      text, bytea, bit, and numeric columns.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      useless index bloat. Users are advised to "REINDEX" such indexes
      after installing this update.
    - Fix bugs in GiST page splitting code for multi-column indexes.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      indexes that are unnecessarily inefficient to search. Users are
      advised to "REINDEX" multi-column GiST indexes after installing
      this update.
    - See HISTORY/changelog.gz for details about the other bug fixes.
 -- Martin Pitt <email address hidden> Tue, 02 Apr 2013 11:52:28 +0200

It's public now: http://www.postgresql.org/about/news/1456/

Making bug public.

Status changed to 'Confirmed' because the bug affects multiple users.

I don't see why the urgency is set to "low" here. The news entry on the PostgreSQL website states clearly "All users of the affected versions are strongly urged to apply the update *immediately*."
And the definition of "urgency" in the Debian policies (unofortunately I haven't been able to find something corresponding on ubuntu.com) is rather clear as well: http://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Urgency

Niko, the urgency field in changelogs is not being used in Ubuntu. The debian uploads do use "high".

postgresql-8.4 (8.4.17-0ubuntu10.04) lucid-security; urgency=low

  * New upstream security/bug fix release: (LP: #1163184)
    - Reset OpenSSL randomness state in each postmaster child process.
      This avoids a scenario wherein random numbers generated by
      "contrib/pgcrypto" functions might be relatively easy for another
      database user to guess. The risk is only significant when the
      postmaster is configured with ssl = on but most connections don't
      use SSL encryption. [CVE-2013-1900]
    - Fix GiST indexes to not use "fuzzy" geometric comparisons when it's
      not appropriate to do so.
      The core geometric types perform comparisons using "fuzzy"
      equality, but gist_box_same must do exact comparisons, else GiST
      indexes using it might become inconsistent. After installing this
      update, users should "REINDEX" any GiST indexes on box, polygon,
      circle, or point columns, since all of these use gist_box_same.
    - Fix erroneous range-union and penalty logic in GiST indexes that
      use "contrib/btree_gist" for variable-width data types, that is
      text, bytea, bit, and numeric columns.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      useless index bloat. Users are advised to "REINDEX" such indexes
      after installing this update.
    - Fix bugs in GiST page splitting code for multi-column indexes.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      indexes that are unnecessarily inefficient to search. Users are
      advised to "REINDEX" multi-column GiST indexes after installing
      this update.
    - See HISTORY/changelog.gz for the other bug fixes.
 -- Martin Pitt <email address hidden> Tue, 02 Apr 2013 12:31:54 +0200

Alright, thanks for the clarification Martin. I'm still used to my old Debian world ;)
Thanks for having the updated packages ready by now. How long do you expect to take them until they hit the repositories?

Niko Ehrenfeuchter [2013-04-04 14:33 -0000]:
> How long do you expect to take them until they hit the repositories?

About an hour ago :-) (except for raring, which will still take half
an hour or so to finish building and publishing)

Is there going to be an 8.4.17-0ubuntu12.04? Thanks.

Alan,

Yes, it is currently building and will be released shortly.

This bug was fixed in the package postgresql-9.1 - 9.1.9-1ubuntu1

---------------
postgresql-9.1 (9.1.9-1ubuntu1) raring; urgency=low

  * Merge with Debian unstable. (LP: #1163184) Remaining Ubuntu changes:
    - debian/rules: Configure for the Tcl/Tk 8.5 multiarch installation.

postgresql-9.1 (9.1.9-1) unstable; urgency=high

  * Urgency high because of critical remote data destruction vulnerability.
  * New upstream security/bug fix release:
    - Fix insecure parsing of server command-line switches.
      A connection request containing a database name that begins with
      "-" could be crafted to damage or destroy files within the server's
      data directory, even if the request is eventually rejected.
      [CVE-2013-1899] (Closes: #704479)
    - Reset OpenSSL randomness state in each postmaster child process.
      This avoids a scenario wherein random numbers generated by
      "contrib/pgcrypto" functions might be relatively easy for another
      database user to guess. The risk is only significant when the
      postmaster is configured with ssl = on but most connections don't
      use SSL encryption. [CVE-2013-1900]
    - Make REPLICATION privilege checks test current user not
      authenticated user.
      An unprivileged database user could exploit this mistake to call
      pg_start_backup() or pg_stop_backup(), thus possibly interfering
      with creation of routine backups. [CVE-2013-1901]
    - Fix GiST indexes to not use "fuzzy" geometric comparisons when it's
      not appropriate to do so.
      The core geometric types perform comparisons using "fuzzy"
      equality, but gist_box_same must do exact comparisons, else GiST
      indexes using it might become inconsistent. After installing this
      update, users should "REINDEX" any GiST indexes on box, polygon,
      circle, or point columns, since all of these use gist_box_same.
    - Fix erroneous range-union and penalty logic in GiST indexes that
      use "contrib/btree_gist" for variable-width data types, that is
      text, bytea, bit, and numeric columns.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      useless index bloat. Users are advised to "REINDEX" such indexes
      after installing this update.
    - Fix bugs in GiST page splitting code for multi-column indexes.
      These errors could result in inconsistent indexes in which some
      keys that are present would not be found by searches, and also in
      indexes that are unnecessarily inefficient to search. Users are
      advised to "REINDEX" multi-column GiST indexes after installing
      this update.
    - See HISTORY/changelog.gz for details about the other bug fixes.
  * Bump Standards-Version to 3.9.4 (no changes necessary).
 -- Martin Pitt <email address hidden> Thu, 04 Apr 2013 16:01:02 +0200