Thomas Perale fd7f102936 package/postgresql: security bump to v17.8 ...

For more information about the release, see:
  - https://www.postgresql.org/docs/17/release-17-8.html

Fixes the following vulnerabilities:

- CVE-2026-2003:
    Improper validation of type "oidvector" in PostgreSQL allows a
    database user to disclose a few bytes of server memory.  We have not
    ruled out viability of attacks that arrange for presence of
    confidential information in disclosed bytes, but they seem unlikely.
    Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are
    affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2003

- CVE-2026-2004:
    Missing validation of type of input in PostgreSQL intarray extension
    selectivity estimator function allows an object creator to execute
    arbitrary code as the operating system user running the database.
    Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are
    affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2004

- CVE-2026-2005:
    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext
    provider to execute arbitrary code as the operating system user
    running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12,
    15.16, and 14.21 are affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2005

- CVE-2026-2006:
    Missing validation of multibyte character length in PostgreSQL text
    manipulation allows a database user to issue crafted queries that
    achieve a buffer overrun.  That suffices to execute arbitrary code as
    the operating system user running the database.  Versions before
    PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-2006

COPYRIGHT year updated in [1].

[1] 625e4495bf

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
(cherry picked from commit a5a1171ca3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

2026-02-26 10:23:39 +01:00

..

Config.in

…

pg_config

…

postgresql.hash

…

postgresql.mk

…

postgresql.service

…

S50postgresql

…