New upstream microreleases 9.5.25 10.16 12.6 13.2

Bug #1915254 reported by Christian Ehrhardt 
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
postgresql-10 (Ubuntu)
Bionic
Fix Released
Undecided
Unassigned
postgresql-12 (Ubuntu)
Focal
Fix Released
Undecided
Unassigned
Groovy
Fix Released
Undecided
Unassigned
postgresql-13 (Ubuntu)
Fix Released
Undecided
Unassigned
postgresql-9.5 (Ubuntu)
Xenial
Fix Released
Undecided
Unassigned

Bug Description

[Impact]

 * MRE for latest stable fixes of Postgres released on February 11th

[Test Case]

 * The Postgres MREs traditionally rely on the large set of autopkgtests
   to run for verification. In a PPA those are all already pre-checked to
   be good for this upload.

[Regression Potential]

 * Upstreams tests are usually great and in additon in the Archive there
   are plenty of autopkgtests that in the past catched issues before being
   released.
   But never the less there always is a risk for something to break. Since
   these are general stable releases I can't pinpoint them to a most-likely
   area.
   - usually this works smoothly except a few test hickups (flaky) that need to be
     clarified to be sure. Pre-checks will catch those to be discussed upfront (as last time)

[Other Info]

 * This is a reoccurring MRE, see below and all the references
 * This includes a fix for one CVE:
    CVE-2021-3393 - only v12 for on Focal/Groovy

---

Current versions in supported releases:
 postgresql-12 | 12.5-0ubuntu0.20.10.1 | groovy-security | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-12 | 12.5-0ubuntu0.20.04.1 | focal-security | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x
 postgresql-10 | 10.15-0ubuntu0.18.04.1 | bionic-security | source, amd64, arm64, armhf, i386, ppc64el, s390x
 postgresql-9.5 | 9.5.24-0ubuntu0.16.04.1 | xenial-security | source, amd64, arm64, armhf, i386, powerpc, ppc64el, s390x

Special cases:
- Hirsute will as usual be synced from Debian.
 Currently on 13.1 still
 postgresql-13 | 13.1-1build1 | hirsute | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Standing MRE - Consider last updates as template:
- pad.lv/1637236
- pad.lv/1664478
- pad.lv/1690730
- pad.lv/1713979
- pad.lv/1730661
- pad.lv/1747676
- pad.lv/1752271
- pad.lv/1786938
- pad.lv/1815665
- pad.lv/1828012
- pad.lv/1833211
- pad.lv/1839058
- pad.lv/1863108
- pad.lv/1892335

As usual we test and prep from the PPA and then push through SRU/Security as applicable.

Related branches

CVE References

no longer affects: postgresql-12 (Ubuntu)
Changed in postgresql-9.5 (Ubuntu Xenial):
status: New → Triaged
Changed in postgresql-13 (Ubuntu Hirsute):
status: New → Incomplete
Changed in postgresql-12 (Ubuntu Groovy):
status: New → Triaged
Changed in postgresql-12 (Ubuntu Focal):
status: New → Triaged
Changed in postgresql-10 (Ubuntu Bionic):
status: New → Triaged
description: updated
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Xenial and Bionic tests complete, no remaining issues shown.
Focal and Groovy still running.

information type: Private Security → Public Security
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

All pre-sniff tests are good:
https://bileto.ubuntu.com/excuses/4431/xenial.html
https://bileto.ubuntu.com/excuses/4432/bionic.html
https://bileto.ubuntu.com/excuses/4433/focal.html
https://bileto.ubuntu.com/excuses/4434/groovy.html

The one bit that is left is Focals runs on libreoffice for arm. That doesn't look like a bug due to postgresql and is known to be flaky. I'm not going to consume autopkgtest resources retrying this too often.

This is ready to upload and X/B will be uploaded to -unapproved now.
F/G due to the CVE fixes will be released through -security.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-12 - 12.6-0ubuntu0.20.10.1

---------------
postgresql-12 (12.6-0ubuntu0.20.10.1) groovy-security; urgency=medium

  * New upstream version (LP: #1915254)
    + Fix incorrect detection of concurrent page splits while inserting
      into a GiST index (Heikki Linnakangas)

      Concurrent insertions could lead to a corrupt index with entries
      placed in the wrong pages. It's recommended to reindex any GiST
      index that's been subject to concurrent insertions.

    + Fix CREATE INDEX CONCURRENTLY to wait for concurrent prepared
      transactions (Andrey Borodin)

      At the point where CREATE INDEX CONCURRENTLY waits for all concurrent
      transactions to complete so that it can see rows they inserted, it
      must also wait for all prepared transactions to complete, for the
      same reason. Its failure to do so meant that rows inserted by
      prepared transactions might be omitted from the new index, causing
      queries relying on the index to miss such rows. In installations that
      have enabled prepared transactions (max_prepared_transactions > 0),
      it's recommended to reindex any concurrently-built indexes in case
      this problem occurred when they were built.

    + Fix information leakage in constraint-violation error messages
      (Heikki Linnakangas)

      If an UPDATE command attempts to move a row to a different partition
      but finds that it violates some constraint on the new partition, and
      the columns in that partition are in different physical positions
      than in the parent table, the error message could reveal the contents
      of columns that the user does not have SELECT privilege on.
      (CVE-2021-3393)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/10/static/release-12-6.html

 -- Christian Ehrhardt <email address hidden> Wed, 10 Feb 2021 11:47:33 +0100

Changed in postgresql-12 (Ubuntu Groovy):
status: Triaged → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-12 - 12.6-0ubuntu0.20.04.1

---------------
postgresql-12 (12.6-0ubuntu0.20.04.1) focal-security; urgency=medium

  * New upstream version (LP: #1915254)
    + Fix incorrect detection of concurrent page splits while inserting
      into a GiST index (Heikki Linnakangas)

      Concurrent insertions could lead to a corrupt index with entries
      placed in the wrong pages. It's recommended to reindex any GiST
      index that's been subject to concurrent insertions.

    + Fix CREATE INDEX CONCURRENTLY to wait for concurrent prepared
      transactions (Andrey Borodin)

      At the point where CREATE INDEX CONCURRENTLY waits for all concurrent
      transactions to complete so that it can see rows they inserted, it
      must also wait for all prepared transactions to complete, for the
      same reason. Its failure to do so meant that rows inserted by
      prepared transactions might be omitted from the new index, causing
      queries relying on the index to miss such rows. In installations that
      have enabled prepared transactions (max_prepared_transactions > 0),
      it's recommended to reindex any concurrently-built indexes in case
      this problem occurred when they were built.

    + Fix information leakage in constraint-violation error messages
      (Heikki Linnakangas)

      If an UPDATE command attempts to move a row to a different partition
      but finds that it violates some constraint on the new partition, and
      the columns in that partition are in different physical positions
      than in the parent table, the error message could reveal the contents
      of columns that the user does not have SELECT privilege on.
      (CVE-2021-3393)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/10/static/release-12-6.html

 -- Christian Ehrhardt <email address hidden> Wed, 10 Feb 2021 11:47:33 +0100

Changed in postgresql-12 (Ubuntu Focal):
status: Triaged → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Christian, or anyone else affected,

Accepted postgresql-10 into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/postgresql-10/10.16-0ubuntu0.18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in postgresql-10 (Ubuntu Bionic):
status: Triaged → Fix Committed
tags: added: verification-needed verification-needed-bionic
Revision history for this message
Brian Murray (brian-murray) wrote :

Hello Christian, or anyone else affected,

Accepted postgresql-9.5 into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/postgresql-9.5/9.5.25-0ubuntu0.16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in postgresql-9.5 (Ubuntu Xenial):
status: Triaged → Fix Committed
tags: added: verification-needed-xenial
Mathew Hodson (mhodson)
no longer affects: postgresql-13 (Ubuntu Hirsute)
Changed in postgresql-13 (Ubuntu):
status: New → Fix Committed
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (postgresql-10/10.16-0ubuntu0.18.04.1)

All autopkgtests for the newly accepted postgresql-10 (10.16-0ubuntu0.18.04.1) for bionic have finished running.
The following regressions have been reported in tests triggered by the package:

dovecot/1:2.2.33.2-1ubuntu4.7 (armhf)
postgresql-common/190ubuntu0.1 (i386)
redmine/3.4.4-1ubuntu0.1 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/bionic/update_excuses.html#postgresql-10

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Hmm ... all those ran fine against the PPA, I've re-queued the tests for now.
Of those tests we have:
- dovecot - known to be flaky on armhf
- postgresql-common - looks like a race on service start
- redmine - the postinst could not connect

The latter I was manually installing from proposed in bionic (redmine of -release vs postgres of -proposed).
$ apt install postgresql redmine-pgsql redmine apache2 libapache2-mod-passenger curl
It worked fine, so a retry might be worth a try here as well.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

FYI - reported test issues on bionic resolved by now.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Complete in Hirsute as well
 postgresql-13 | 13.2-1 | hirsute | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

Changed in postgresql-13 (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I've found no other issues and also the multitude of dep8 tests all completed.
https://people.canonical.com/~ubuntu-archive/proposed-migration/bionic/update_excuses.html#postgresql-10
https://people.canonical.com/~ubuntu-archive/proposed-migration/xenial/update_excuses.html#postgresql-9.5

Per the agreed polciy for this MRE I'm setting the verified tags.

tags: added: verification-done verification-done-bionic verification-done-xenial
removed: verification-needed verification-needed-bionic verification-needed-xenial
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-10 - 10.16-0ubuntu0.18.04.1

---------------
postgresql-10 (10.16-0ubuntu0.18.04.1) bionic; urgency=medium

  * New upstream version (LP: #1915254)
    + Fix CREATE INDEX CONCURRENTLY to wait for
      concurrent prepared transactions (Andrey Borodin)

      At the point where CREATE INDEX CONCURRENTLY
      waits for all concurrent transactions to complete so that it can see
      rows they inserted, it must also wait for all prepared transactions
      to complete, for the same reason. Its failure to do so meant that
      rows inserted by prepared transactions might be omitted from the new
      index, causing queries relying on the index to miss such rows.
      In installations that have enabled prepared transactions
      (max_prepared_transactions > 0),
      it's recommended to reindex any concurrently-built indexes in
      case this problem occurred when they were built.

    + Details about this and many further changes can be found at:
      https://www.postgresql.org/docs/10/static/release-10-16.html

 -- Christian Ehrhardt <email address hidden> Wed, 10 Feb 2021 11:47:35 +0100

Changed in postgresql-10 (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for postgresql-10 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package postgresql-9.5 - 9.5.25-0ubuntu0.16.04.1

---------------
postgresql-9.5 (9.5.25-0ubuntu0.16.04.1) xenial; urgency=medium

  * New upstream version (LP: #1915254)
    + Fix CREATE INDEX CONCURRENTLY to wait for
      concurrent prepared transactions (Andrey Borodin)

      At the point where CREATE INDEX CONCURRENTLY
      waits for all concurrent transactions to complete so that it can see
      rows they inserted, it must also wait for all prepared transactions
      to complete, for the same reason. Its failure to do so meant that
      rows inserted by prepared transactions might be omitted from the new
      index, causing queries relying on the index to miss such rows.
      In installations that have enabled prepared transactions
      (max_prepared_transactions > 0),
      it's recommended to reindex any concurrently-built indexes in
      case this problem occurred when they were built.

    + Details about this and many further changes can be found at:
      https://www.postgresql.org/docs/9.5/static/release-9-5-25.html

 -- Christian Ehrhardt <email address hidden> Wed, 10 Feb 2021 11:47:36 +0100

Changed in postgresql-9.5 (Ubuntu Xenial):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.