-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 10 May 2023 20:35:39 +0200 Source: postgresql-13 Architecture: source Version: 13.11-0+deb11u1 Distribution: bullseye-security Urgency: medium Maintainer: Debian PostgreSQL Maintainers Changed-By: Christoph Berg Changes: postgresql-13 (13.11-0+deb11u1) bullseye-security; urgency=medium . * New upstream version. . + Prevent CREATE SCHEMA from defeating changes in search_path (Report and fix by Alexander Lakhin, CVE-2023-2454) . Within a CREATE SCHEMA command, objects in the prevailing search_path, as well as those in the newly-created schema, would be visible even within a called function or script that attempted to set a secure search_path. This could allow any user having permission to create a schema to hijack the privileges of a security definer function or extension script. . + Enforce row-level security policies correctly after inlining a set-returning function (Report by Wolfgang Walther, CVE-2023-2455) . If a set-returning SQL-language function refers to a table having row-level security policies, and it can be inlined into a calling query, those RLS policies would not get enforced properly in some cases involving re-using a cached plan under a different role. This could allow a user to see or modify rows that should have been invisible. Checksums-Sha1: 9575212f6f3bebc97ef6ed7d958197de8d495e88 3703 postgresql-13_13.11-0+deb11u1.dsc 501acb24ba8539c08ba12b08adecd7559bf87e1b 21519655 postgresql-13_13.11.orig.tar.bz2 93dc0d58d69d1ebecd6e062ac3502d787eb3c060 30160 postgresql-13_13.11-0+deb11u1.debian.tar.xz Checksums-Sha256: eaa5b109ae2d02a847dc7e6dc5263539ccb79dee6a130fd1228e59aa375831c7 3703 postgresql-13_13.11-0+deb11u1.dsc 4992ff647203566b670d4e54dc5317499a26856c93576d0ea951bdf6bee50bfb 21519655 postgresql-13_13.11.orig.tar.bz2 f4dc062b966ab53fece8116eb4919629a8d4bbe2045786b0015f893fa7852ea1 30160 postgresql-13_13.11-0+deb11u1.debian.tar.xz Files: da018b47f1ba68026ada09807b67379b 3703 database optional postgresql-13_13.11-0+deb11u1.dsc b4fcb4a73180840f23cb3a09cd01d9dc 21519655 database optional postgresql-13_13.11.orig.tar.bz2 37a1dd004a8dc5762435c86ba2e77e3e 30160 database optional postgresql-13_13.11-0+deb11u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEXEj+YVf0kXlZcIfGTFprqxLSp64FAmRb5t8ACgkQTFprqxLS p65CURAAlAkCrbbE28ia+NBGo94PiC1XkTriafEEpETz8uPOU+q2sReoP8x1ICdU 2TJRyXBUzCIfB6qfx+YhDXzs7ZjKFAkkSqX+GKOHG51aRyTmz4/2ZSsMh7lADRgh QsjdfFan+Pi/aqx9TFhHOTzSY3oZScEe0FBa2MnoOpJjY8sM7AQZZQsRZvsxTTyj 1PZIuDvslTlANlTgrsA23nVAeJCcrAhJe1sKr9BtJgLL4+gGdNM5sweQ1ionqZyC X0DszyYTXve/l7BIRQqGtOcmshXjIISWaxzjf8FEzjv74MW6kUJ+kodlMJJo8DE5 WgFZq24u+OOIO3FerX5Ur5lLXhSPHR+uyOVIlZH3zUpzAgLvTkAFZ4EL7iS5vEio JjNT2FWyedhy1osotKh2hvqcXjetWv7V7fCe7kkakEm1X1yBq+XcPohKynFbqf05 9i8he4hSxX1flbCNafcfz7JLMIdKhGrqNVqFslYCgCUrp29HzC6oSHh/VK2NGXWU w2fSA41FpTLci7EijUGUibia6FjGSuavxf4vSDhh1q9Azq0c/CBCFryDVje1lyvG L/wwa+Y6nbWA1Kh3YP7ma7Ixho02DEL2/XfJIXjQs/hubY8AlYpAjhQFmhBKgxEg sUzZOgyiTDNvIahkqDCsxEyfxWKE3YCkxEzFo+VKJPI6AeARUdY= =xv7O -----END PGP SIGNATURE-----