postgresql-18 (18.6-0ubuntu0.26.04.1) resolute-security; urgency=medium

  * New upstream version (LP: #2153489)

    + Note: 18.5 was never released, due to a regression discovered post-wrap.

    + A dump/restore is not required for those running 18.X.

    + However, the first three security entries below describe configuration
      adjustments and data cleanups that you may need to make after updating.

    + Also, if you have any GIN indexes, see the changelog entry below about
      possibly-corrupt reltuples values for their tables.

    + Also, if you use contrib/btree_gist or contrib/ltree, you may need to
      reindex indexes made with those extensions; see the relevant entries
      below.

    + Also, if you are upgrading from a version earlier than 18.2, see those
      release notes as well please.

    + Restrict logical decoding output plugins to the set specified by a new
      server parameter output_plugin_libraries

      Previously, a replication user could select any loadable library for
      logical decoding, allowing exploits of various sorts. To allow locking
      this down without breaking setups that worked before, introduce a
      whitelist of allowed output plugins.

      By default, only the output plugins shipped as part of PostgreSQL
      (pgoutput and test_decoding) are included in output_plugin_libraries.
      Installations that rely on other output plugins must add them after
      updating the server.

      Additionally, pg_upgrade --check will fail if the
      output_plugin_libraries parameter on the new cluster does not permit the
      plugins of logical replication slots on the old cluster, when migrating
      from versions 17 and later. Make necessary additions to the new
      cluster's setting before performing pg_upgrade. (CVE-2026-6471)

    + Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers

      Previously, if OpenSSL rejected the requested cipher (for example,
      because it is running in FIPS mode, or the legacy provider hasn't been
      loaded), pgcrypto failed to notice the failure and simply XOR'd the
      non-encrypted block with the plaintext, rendering the “encryption”
      trivially breakable. This will typically occur with deprecated or
      non-FIPS cipher algorithms (cipher-algo=blowfish/bf, twofish, cast5, or
      3des).

      By default, pgcrypto will now fail to decrypt any messages that were
      affected in this way. To allow retrieval of such data, a new option
      ignore-cipher-failure has been added to pgp_pub_decrypt() and
      pgp_sym_decrypt(). Setting ignore-cipher-failure=1 will restore their
      previous behavior, allowing the faulty encryption wrapper to be stripped
      off.

      Once the affected messages are identified and stripped of their
      wrappers, they can then be re-encrypted with a modern algorithm. It is
      important however that the behavior of OpenSSL be the same as it was
      when the faulty messages were created: if the set of unsupported
      algorithms is not the same, this approach will not work. See the
      documentation for ignore-cipher-failure. (CVE-2026-14663)

    + Fix psql to skip in-line data following a scripted COPY ... FROM STDIN
      command, even if the COPY fails before sending PGRES_COPY_IN

      Previously, if a COPY command failed at startup (for instance, because
      the target table doesn't exist) psql would not realize that and would
      proceed to read the following in-line data as SQL commands. In the best
      case that's wrong and in the worst case it's a SQL-injection hazard.
      Teach psql to recognize syntactically-valid COPY ... FROM STDIN commands
      and to skip data on its own authority if the server doesn't respond with
      PGRES_COPY_IN.

      While this fix is unlikely to affect any production SQL scripts, test
      scripts might intentionally exercise failing COPY ... FROM STDIN
      commands. Those will need to gain a . data terminator line after each
      such command. (CVE-2026-6464)

    + Cross-check the output row type of a portal running EXECUTE or FETCH

      EXECUTE and FETCH use two portals: an outer one for the statement
      itself, and an inner one running the query being executed on its behalf.
      It was previously possible to make the declared row types of the two
      portals diverge, leading to server memory disclosure and arbitrary code
      execution. (CVE-2026-16239)

    + Fix buffer overrun with long time zone abbreviation in to_char()

      This can easily crash the server, and exploits leading to arbitrary code
      execution have been reported. (CVE-2026-14669)

    + Fix buffer overrun in regexp match/split functions

      If passed invalidly-encoded data, these functions could write past the
      end of their conversion buffer. (CVE-2026-14664)

    + Harden the ascii() function against invalid input

      By supplying invalidly-encoded input, this function could be coaxed to
      read and return a few bytes of data that it shouldn't. In assert-enabled
      builds, its assertions could be triggered too. (CVE-2026-18024)

    + Fix multirange type handling in pg_restore_attribute_stats()

      pg_restore_attribute_stats() treated multirange types just like their
      underlying range type. This works correctly for the bounds histogram,
      but it was wrong for all the other statistics kinds. (CVE-2026-16238)

    + Make scalarineqsel() check that a constant it expects to be of type tid
      actually is

      This expectation will hold for all the built-in operators that use this
      estimator, but a maliciously-constructed operator could violate it,
      leading to a crash or server memory disclosure. (CVE-2026-14668)

    + Harden tsvector and tsquery code against overly long values (both
      individual lexemes and total vector/query length)

      The documented limits were not enforced in all code paths.
      (CVE-2026-14662)

    + Fix various places that mistakenly assumed they would not have to deal
      with more than FUNC_MAX_ARGS function arguments

      Notably, the server's actual limit on the number of arguments to an
      aggregate function is FUNC_MAX_ARGS - 1, but the parser failed to
      enforce that, creating hazards downstream. (CVE-2026-14679)

    + Reject calls from SQL to functions that take or return type internal

      The existing defenses against doing this have been shown to be
      insufficient, so add more explicit checks. (CVE-2026-14680)

    + Preserve the ownership of extended statistics objects when they are
      rebuilt by ALTER TABLE

      Previously, the role running ALTER TABLE gained ownership of such
      objects, but that seems inappropriate. (CVE-2026-6469)

    + When deparsing an EXTRACT() function call, quote the field name if
      needed

      The parser accepts any string literal as a field name in EXTRACT(),
      deferring validation to execution. If the call is stored and deparsed
      (for example during pg_dump), the string body was regurgitated verbatim,
      allowing SQL injection. (CVE-2026-15741)

    + Check for USAGE privilege on data types in places that formerly failed
      to check that

      CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor did
      commands that create stored expressions. These omissions allowed roles
      without USAGE privilege to nonetheless create objects depending on the
      type, possibly blocking the type's owner from changing the type later.
      (CVE-2026-6470)

    + Invalidate role-dependent cached plans after role changes

      Role membership, role attribute, and database ownership changes may
      impact the expected behavior of row-level security policies, but
      previously we'd continue to use cached plans that were made according to
      the old state of affairs. (CVE-2026-14666)

    + Reject GSSEncRequest after direct SSL connection

      After establishing a TLS-encrypted connection, the server would still
      accept a request for GSSAPI encryption. If that succeeded, the
      connection would proceed using TLS encryption, but it would look like a
      GSS connection to the pg_hba rules. Thus, a pg_hba policy intending to
      disallow TLS would not be enforced correctly. (CVE-2026-14681)

    + Make mock SCRAM authentication secrets more plausible

      If a SCRAM login is attempted against a role that doesn't exist or
      doesn't have a SCRAM secret, we generate a mock secret and carry out the
      authentication handshake anyway, to avoid revealing these facts to an
      attacker. But the mock secret was made with a fixed iteration count,
      which in itself can be an observable response discrepancy. Use the
      configuration setting scram_iterations instead, to make the mock secret
      look more like the installation's real secrets. (CVE-2026-14672)

    + Fix out-of-bounds writes in ecpg applications caused by invalid bytea
      data received from the server

      ecpg assumed without checking that any bytea value must begin with x. A
      broken or malicious server might send a string shorter than 2 bytes,
      resulting in memory clobber in the application. (CVE-2026-16241)

    + Do not do backquote expansion on the argument of psql's unrestrict
      command

      This oversight in the fix for CVE-2025-8714 allows a malicious server to
      inject shell commands into plain-text dump output that will be run at
      restore time on the machine running psql, the exact scenario that
      CVE-2025-8714 intended to prevent. (CVE-2026-18408)

    + Remove pg_dump's assumption that pg_proc.protrftypes cannot have more
      than FUNC_MAX_ARGS entries

      Since there could be entries for both input and output arguments, it's
      feasible for this array's length to exceed FUNC_MAX_ARGS (which
      constrains only input arguments). Even if that were not so, pg_dump
      cannot assume that the server was built with the same value of
      FUNC_MAX_ARGS that it has. An overrun would lead to a memory clobber
      inside pg_dump. (CVE-2026-19385)

    + Harden PL/Perl against “tied” Perl arrays and hashes

      A tied object that doesn't behave like a regular one could lead to
      memory overwrite, or to constructing a corrupt result array (which would
      likely cause problems later). (CVE-2026-14670)

    + Fix integer overflows in memory-allocation calculations in PL/Perl and
      PL/Tcl

      This is the same type of problem as CVE-2026-6473, just in a different
      part of the code, and is fixed in the same way. (CVE-2026-14677)

    + Ensure that contrib/amcheck functions restrict search_path before
      executing index expressions

      Because amcheck will run such index expressions as the owner of their
      tables, a caller could potentially hijack search_path-dependent
      functions to run arbitrary code as the table owner. By default this is
      not a vulnerability because only superusers are allowed to call amcheck
      functions; but if that privilege was granted out, it created a larger
      hazard than the documentation suggests. (CVE-2026-14673)

    + Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and
      levenshtein_less_equal() functions

      Passing large cost values to these functions could cause integer
      overflows, thereby producing nonsensical results, and even causing
      out-of-bounds writes in some cases. (CVE-2026-15742)

    + Fix buffer overrun in contrib/pg_stat_statements

      Query normalization didn't accurately account for the amount of space
      the normalized string would require. (CVE-2026-14676)

    + Fix datatype error in contrib/pg_trgm's GiST picksplit function

      This mistake resulted in reading past the end of the buffer, typically
      causing bad split decisions; but a crash could ensue if you're very
      unlucky. (CVE-2026-14678)

    + Remove the plan cache in contrib/refint

      This caching behavior has several serious bugs, notably that
      check_foreign_key() embeds the new key values in its cascade-UPDATE
      queries, so a cached plan reuses the originally-needed values rather
      than the key values that should be used. The simplest solution is to
      remove it. (CVE-2026-14671)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/18/release-18-6.html.

  * d/postgresql-18.NEWS: update NEWS file.

 -- Guilherme Puida Moreira <guilherme.moreira@canonical.com>  Thu, 13 Aug 2026 16:29:43 -0300

postgresql-18 (18.4-0ubuntu0.26.04.1) resolute-security; urgency=medium

  * New upstream version (LP: #2152636).

    + A dump/restore is not required for those running 16.X.

    + However, if you are upgrading from a version earlier than 18.2, see
      those release notes as well please.

    + Prevent unbounded recursion while processing startup packets

      A malicious client could crash the connected backend by alternating
      rejected SSL and GSS encryption requests indefinitely. (CVE-2026-6479)

    + Fix assorted integer overflows in memory-allocation calculations

      Various places were incautious about the possibility of integer overflow
      in calculations of how much memory to allocate. Overflow would lead to
      allocating a too-small buffer which the caller would then write past the
      end of. This would at least trigger server crashes, and probably could
      be exploited for arbitrary code execution. In many but by no means all
      cases, the hazard exists only in 32-bit builds. (CVE-2026-6473)

    + Properly quote subscription names in pg_createsubscriber

      The given subscription name was inserted into SQL commands without
      quoting, so that SQL injection could be achieved in the (perhaps
      unlikely) case that the subscription name comes from an untrusted
      source. (CVE-2026-6476)

    + Properly quote object names in logical replication origin checks

      ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolated schema and
      relation names into SQL commands without quoting them, allowing
      execution of arbitrary SQL on the publisher. (CVE-2026-6638)

    + Reject over-length options in ts_headline()

      The StartSel, StopSel and FragmentDelimiter strings must not exceed 32Kb
      in length, but this was not checked for. An over-length value would
      typically crash the server. (CVE-2026-6473)

    + Detect faulty input when restoring attribute MCV statistics

      The statistics restore functions were insufficiently careful about
      validating most-common-value statistics, and would accept values that
      could crash the planner later on. (CVE-2026-6575)

    + Guard against malicious time zone names in timeofday() and pg_strftime()

      A crafted time zone setting could pass % sequences to snprintf(),
      potentially causing crashes or disclosure of server memory. Another path
      to similar results was to overflow the limited-size output buffer used
      by pg_strftime(). (CVE-2026-6474)

    + When creating a multirange type, ensure the user has CREATE privilege on
      the schema specified for the multirange type

      The multirange type can be put into a different schema than its parent
      range type, but we neglected to apply the required privilege check when
      doing so. (CVE-2026-6472)

    + Use timing-safe string comparisons in authentication code

      Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking
      passwords, hashes, etc. It is not known whether the data dependency of
      those functions is usefully exploitable in any of these places, but in
      the interests of safety, replace them. (CVE-2026-6478)

    + Mark PQfn() as unsafe, and avoid using it within libpq

      For a non-integral result type, PQfn() is not passed the size of the
      output buffer, so it cannot check that the data returned by the server
      will fit. A malicious server could therefore overwrite client memory.
      This is unfixable without an API change, so mark the function as
      deprecated. Internally to libpq, use a variant version that can apply
      the missing check. (CVE-2026-6477)

    + Prevent path traversal in pg_basebackup and pg_rewind

      These applications failed to validate output file paths read from their
      input, so that a malicious source could overwrite any file writable by
      these applications. Constrain where data can be written by rejecting
      paths that are absolute or contain parent-directory references.
      (CVE-2026-6475)

    + Guard against field overflow within contrib/intarray's query_int type
      and contrib/ltree's ltxtquery type

      Parsing of these query structures did not check for overflow of 16-bit
      fields, so that construction of an invalid query tree was possible. This
      can crash the server when executing the query. (CVE-2026-6473)

    + Guard against overly long values of contrib/ltree's lquery type

      Values with more than 64K items caused internal overflows, potentially
      resulting in stack smashes or wrong answers. (CVE-2026-6473)

    + Prevent SQL injection and buffer overruns in contrib/spi

      check_foreign_key() was insufficiently careful about quoting key values,
      and also used fixed-length buffers for constructing queries. While this
      module is only meant as example code, it still shouldn't contain such
      dangerous errors. (CVE-2026-6637)

    + Details about these and many further changes can be found at:
      https://www.postgresql.org/docs/18/release-18-4.html.

  * d/postgresql-18.NEWS: add NEWS file.

 -- Athos Ribeiro <athos@ubuntu.com>  Fri, 15 May 2026 05:16:50 -0300

postgresql-18 (18.3-1) unstable; urgency=medium

  * New upstream version 18.3.

    + Fix failure after replaying a multixid truncation record from WAL that
      was generated by an older minor version (Heikki Linnakangas)

      Erroneous logic for coping with the way that previous versions handled
      multixid wraparound led to replay failure, with messages like "could not
      access status of transaction". A typical scenario in which this could
      occur is a standby server of the latest minor version consuming WAL from
      a primary server of an older version.

    + Avoid incorrect complaint of invalid encoding when substring() is
      applied to toasted data (Noah Misch)

      The fix for CVE-2026-2006 was too aggressive and could raise an error
      about an incomplete character in cases that are actually valid.

    + Fix oversight in the fix for CVE-2026-2007 (Zsolt Parragi)

      If the bounds array needed to be expanded, because the input contained
      more trigrams than the initial guess, generate_trgm_only didn't return
      the modified array pointer to its caller.  That would lead to incorrect
      output from strict_word_similarity() and related functions, or in rare
      cases a crash.  The faulty code is reached if the input string becomes
      longer when it's converted to lower case. The only known instances of
      that occur when an ICU locale is used with certain single-byte
      encodings.

    + Fix the volatility marking of json_strip_nulls() and jsonb_strip_nulls()
      (Andrew Dunstan)

      These functions have always been considered immutable, but refactoring
      in version 18 accidentally marked them stable instead. That prevents
      their use in index expressions and could cause unnecessary repeat
      evaluations in queries.  This fix corrects the marking in
      newly-initialized database clusters (including clusters that are
      pg_upgrade'd to 18.3 or later). However it will not help existing
      clusters made using 18.0 through 18.2.

      If this mistake affects your usage of these functions, the recommended
      fix for an existing cluster is a manual catalog update. As superuser,
      perform

      UPDATE pg_catalog.pg_proc SET provolatile = 'i' WHERE oid IN ('3261','3262');

      in each affected database.  Update template0 and template1 as well, so
      that databases made in future will have the fix.

 -- Christoph Berg <myon@debian.org>  Tue, 24 Feb 2026 12:48:56 +0100

postgresql-18 (18.2-1) unstable; urgency=medium

  * New upstream version 18.2.

    + Guard against unexpected dimensions of oidvector/int2vector (Tom Lane)

      These data types are expected to be 1-dimensional arrays containing no
      nulls, but there are cast pathways that permit violating those
      expectations.  Add checks to some functions that were depending on those
      expectations without verifying them, and could misbehave in consequence.

      The PostgreSQL Project thanks Altan Birler for reporting this problem.
      (CVE-2026-2003)

    + Harden selectivity estimators against being attached to operators that
      accept unexpected data types (Tom Lane)

      contrib/intarray contained a selectivity estimation function that could
      be abused for arbitrary code execution, because it did not check that
      its input was of the expected data type.  Third-party extensions should
      check for similar hazards and add defenses using the technique intarray
      now uses. Since such extension fixes will take time, we now require
      superuser privilege to attach a non-built-in selectivity estimator to an
      operator.

      The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud,
      for reporting this problem. (CVE-2026-2004)

    + Fix buffer overrun in contrib/pgcrypto's PGP decryption functions
      (Michael Paquier)

      Decrypting a crafted message with an overlength session key caused a
      buffer overrun, with consequences as bad as arbitrary code execution.

      The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud,
      for reporting this problem. (CVE-2026-2005)

    + Fix inadequate validation of multibyte character lengths
      (Thomas Munro, Noah Misch)

      Assorted bugs allowed an attacker able to issue crafted SQL to overrun
      string buffers, with consequences as bad as arbitrary code execution.
      After these fixes, applications may observe invalid byte sequence for
      encoding errors when string functions process invalid text that has been
      stored in the database.

      The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of
      zeroday.cloud, for reporting this problem. (CVE-2026-2006)

    + Harden contrib/pg_trgm against changes in string lowercasing behavior
      (Heikki Linnakangas)

      Fix potential buffer overruns arising from the fact that in some locales
      lower-casing a string can produce more characters (not bytes) than were
      in the original.  That behavior is new in version 18, and so is the bug.

      The PostgreSQL Project thanks Heikki Linnakangas for reporting this
      problem. (CVE-2026-2007)

  * Remove pg_numa_init and LLVM 21 patches, merged upstream.

 -- Christoph Berg <myon@debian.org>  Tue, 10 Feb 2026 11:26:19 +0100

postgresql-18 (18.1-2) unstable; urgency=medium

  * Fix build with LLVM 21.

 -- Christoph Berg <myon@debian.org>  Thu, 11 Dec 2025 17:37:16 +0100

postgresql-18 (18.1-1) unstable; urgency=medium

  * New upstream version 18.1.

    + Check for CREATE privileges on the schema in CREATE STATISTICS
      (Jelte Fennema-Nio)

      This omission allowed table owners to create statistics in any schema,
      potentially leading to unexpected naming conflicts.

      The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this
      problem. (CVE-2025-12817)

    + Avoid integer overflow in allocation-size calculations within libpq
      (Jacob Champion)

      Several places in libpq were not sufficiently careful about computing
      the required size of a memory allocation.  Sufficiently large inputs
      could cause integer overflow, resulting in an undersized buffer, which
      would then lead to writing past the end of the buffer.

      The PostgreSQL Project thanks Aleksey Solovev of Positive Technologies
      for reporting this problem. (CVE-2025-12818)

  * Handle EPERM in pg_numa_init.
  * Test-Depend on postgresql-common-dev.

 -- Christoph Berg <myon@debian.org>  Tue, 11 Nov 2025 13:05:55 +0100

postgresql-18 (18.0-1) unstable; urgency=medium

  * PostgreSQL 18.0.
  * B-D on openssl.

 -- Christoph Berg <myon@debian.org>  Tue, 23 Sep 2025 21:46:05 +0200

postgresql-18 (18~rc1-3) unstable; urgency=medium

  * libpq.pc: Drop libcurl from Requires.private.

 -- Christoph Berg <myon@debian.org>  Tue, 23 Sep 2025 17:12:07 +0200

postgresql-18 (18~rc1-2) unstable; urgency=medium

  * Upload to unstable in preparation of 18.0 release.
  * B-D on postgresql-common-dev instead of -common.
  * Drop move-pages32 patch, upstream had a different fix already.

 -- Christoph Berg <myon@debian.org>  Mon, 22 Sep 2025 12:37:17 +0200

postgresql-18 (18~rc1-1) experimental; urgency=medium

  * New upstream version 18rc1.
  * libpq-oauth.lintian-overrides: Package is a plugin.

 -- Christoph Berg <myon@debian.org>  Wed, 13 Aug 2025 23:37:10 +0200

# For older changelog entries, run 'apt-get changelog postgresql-plperl-18'
