Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package postgresql17 for openSUSE:Factory checked in at 2026-08-19 17:58:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/postgresql17 (Old) and /work/SRC/openSUSE:Factory/.postgresql17.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "postgresql17" Wed Aug 19 17:58:08 2026 rev:21 rq:1371819 version:17.11 Changes: -------- --- /work/SRC/openSUSE:Factory/postgresql17/postgresql17.changes 2026-06-16 13:59:50.033288853 +0200 +++ /work/SRC/openSUSE:Factory/.postgresql17.new.1258/postgresql17.changes 2026-08-19 17:58:51.501154203 +0200 @@ -1,0 +2,64 @@ +Sat Aug 15 14:51:05 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to version 17.11: + https://www.postgresql.org/docs/17/release-17-11.html + https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/ + + Security Fixes: + - bsc#1275046, CVE-2026-6464: psql COPY FROM STDIN early failure + processes data lines as psql commands (CVSS v3.1: 8.1) + - bsc#1275044, CVE-2026-6469: ALTER TABLE ALTER TYPE resets + extended statistics ownership (CVSS v3.1: 3.8) + - bsc#1275043, CVE-2026-6470: Fails to check type USAGE privilege + (CVSS v3.1: 4.3) + - bsc#1275042, CVE-2026-6471: Logical decoding can dlopen + arbitrary file (CVSS v3.1: 7.2) + - bsc#1275001, CVE-2026-14662: tsvector and tsquery undersize + allocations, via integer wraparound (CVSS v3.1: 8.8) + - bsc#1275002, CVE-2026-14663: pgcrypto, for OpenSSL-disabled + ciphers, silently encrypts to and decrypts from cleartext (CVSS + v3.1: 6.5) + - bsc#1275068, CVE-2026-14664: Regexp heap buffer overflow + executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275067, CVE-2026-14666: Row security caching disregards + role modifications (CVSS v3.1: 4.2) + - bsc#1275066, CVE-2026-14668: ctid type confusion in selectivity + estimator discloses derivative of arbitrary read (CVSS v3.1: + 8.1) + - bsc#1275065, CVE-2026-14669: to_char heap buffer overflow + executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275064, CVE-2026-14670: plperl tied object heap buffer + overflow executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275063, CVE-2026-14671: refint plan cache type confusion + executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275062, CVE-2026-14672: Observable response discrepancy + with non-default scram_iterations provides user existence + oracle (CVSS v3.1: 5.3) + - bsc#1275059, CVE-2026-14677: 32-bit pltcl and plperl undersize + allocations, via integer wraparound (CVSS v3.1: 8.8) + - bsc#1275058, CVE-2026-14678: pg_trgm picksplit reads past end + of buffer (CVSS v3.1: 4.3) + - bsc#1275057, CVE-2026-14679: Stack buffer overflow in argument + match writes 0x0 and 0x1 to server memory (CVSS v3.1: 8.2) + - bsc#1275056, CVE-2026-14680: Type confusion via "internal" + arguments (CVSS v3.1: 8.8) + - bsc#1275055, CVE-2026-14681: Improper enforcement of GSSAPI + encryption when coupled with SSL (CVSS v3.1: 4.2) + - bsc#1275054, CVE-2026-15741: Expression deparse allows SQL + injection via EXTRACT argument (CVSS v3.1: 8.8) + - bsc#1275053, CVE-2026-15742: fuzzystrmatch writes + effectively-arbitrary addresses, via integer wraparound (CVSS + v3.1: 8.8) + - bsc#1275051, CVE-2026-16239: Type confusion in cursor CLOSE + + DECLARE executes arbitrary code (CVSS v3.1: 8.8) + - bsc#1275050, CVE-2026-16241: ECPG integer underflow can crash + the client (CVSS v3.1: 3.8) + - bsc#1275049, CVE-2026-18024: ascii() function reads past end of + buffer (CVSS v3.1: 4.3) + - bsc#1275048, CVE-2026-18408: psql \unrestrict lets superuser of + pg_dump origin server execute arbitrary code in psql client + (CVSS v3.1: 8.8) + - bsc#1275047, CVE-2026-19385: pg_dump heap buffer overflow + executes arbitrary code (CVSS v3.1: 8.8) + +------------------------------------------------------------------- @@ -9,0 +74,5 @@ + +------------------------------------------------------------------- +Fri Jun 12 20:10:16 UTC 2026 - Marcus Rueckert <[email protected]> + +- bump packaging level to 19 Old: ---- postgresql-17.10.tar.bz2 postgresql-17.10.tar.bz2.sha256 New: ---- postgresql-17.11.tar.bz2 postgresql-17.11.tar.bz2.sha256 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ postgresql17.spec ++++++ --- /var/tmp/diff_new_pack.k79Pxp/_old 2026-08-19 17:58:52.688196736 +0200 +++ /var/tmp/diff_new_pack.k79Pxp/_new 2026-08-19 17:58:52.690196807 +0200 @@ -17,7 +17,7 @@ %define pgmajor 17 -%define pgminor 10 +%define pgminor 11 ### CUT HERE ### %define pgname postgresql%pgmajor @@ -73,7 +73,7 @@ %bcond_without alts Requires: pg_alts %else -%define packaging_level 18 +%define packaging_level 19 %bcond_with alts %define install_alternatives /usr/share/postgresql/install-alternatives %pgmajor %endif ++++++ postgresql-17.10.tar.bz2 -> postgresql-17.11.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/postgresql17/postgresql-17.10.tar.bz2 /work/SRC/openSUSE:Factory/.postgresql17.new.1258/postgresql-17.11.tar.bz2 differ: char 11, line 1 ++++++ postgresql-17.10.tar.bz2.sha256 -> postgresql-17.11.tar.bz2.sha256 ++++++ --- /work/SRC/openSUSE:Factory/postgresql17/postgresql-17.10.tar.bz2.sha256 2026-05-18 17:50:26.058297059 +0200 +++ /work/SRC/openSUSE:Factory/.postgresql17.new.1258/postgresql-17.11.tar.bz2.sha256 2026-08-19 17:58:51.470153092 +0200 @@ -1 +1 @@ -078a03516dcdbdb705fecaf415ea3d13a956c589e46f09fed68a06fb00598c90 postgresql-17.10.tar.bz2 +dd27f2b3c59e73ed14aa3324901242bf69a032a6347805f274e6260322d42979 postgresql-17.11.tar.bz2
