From 4e294ae91078e46f104d997d22748afb896fbc92 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 22 Feb 2026 11:26:35 +0100 Subject: [PATCH] package/postgresql: security bump to v17.8 For more information about the release, see: - https://www.postgresql.org/docs/17/release-17-8.html Fixes the following vulnerabilities: - CVE-2026-2003: Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-2003 - CVE-2026-2004: Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-2004 - CVE-2026-2005: Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-2005 - CVE-2026-2006: Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-2006 COPYRIGHT year updated in [1]. [1] https://github.com/postgres/postgres/commit/625e4495bf58733f1dac24e363b12e6f95d7e92d Signed-off-by: Thomas Perale Reviewed-by: Maxim Kochetkov (cherry picked from commit a5a1171ca3b5688eed233488744c5eb77ed69ec5) Signed-off-by: Thomas Perale --- package/postgresql/postgresql.hash | 6 +++--- package/postgresql/postgresql.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/postgresql/postgresql.hash b/package/postgresql/postgresql.hash index efa1b5e751..b7a2397f8f 100644 --- a/package/postgresql/postgresql.hash +++ b/package/postgresql/postgresql.hash @@ -1,4 +1,4 @@ -# From https://ftp.postgresql.org/pub/source/v17.7/postgresql-17.7.tar.bz2.sha256 -sha256 ef9e343302eccd33112f1b2f0247be493cb5768313adeb558b02de8797a2e9b5 postgresql-17.7.tar.bz2 +# From https://ftp.postgresql.org/pub/source/v17.8/postgresql-17.8.tar.bz2.sha256 +sha256 a88d195dd93730452d0cfa1a11896720d6d1ba084bc2be7d7fc557fa4e4158a0 postgresql-17.8.tar.bz2 # License file, Locally calculated -sha256 5ed3ce5c9373dff7f98b1fae7a6c7ccd98df7d734d46d24c1bcebf1240be8307 COPYRIGHT +sha256 3d6af92ff8a4c2cdf69afb1cf44edea727922f5cd0cf8b5f72b11cdecac8fdfd COPYRIGHT diff --git a/package/postgresql/postgresql.mk b/package/postgresql/postgresql.mk index 13abce8330..9856d6423b 100644 --- a/package/postgresql/postgresql.mk +++ b/package/postgresql/postgresql.mk @@ -4,7 +4,7 @@ # ################################################################################ -POSTGRESQL_VERSION = 17.7 +POSTGRESQL_VERSION = 17.8 POSTGRESQL_SOURCE = postgresql-$(POSTGRESQL_VERSION).tar.bz2 POSTGRESQL_SITE = https://ftp.postgresql.org/pub/source/v$(POSTGRESQL_VERSION) POSTGRESQL_LICENSE = PostgreSQL