From nobody Thu Feb 8 21:29:19 2024 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TW99C2djRz5BQGK; Thu, 8 Feb 2024 21:29:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TW99C2357z50QJ; Thu, 8 Feb 2024 21:29:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1707427759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ypzqz30zXAd6jJmaNjfZZ3vP9QqifNTTuq1Gw6w8dBs=; b=t9DJpo55mdbD9HkP1wNrKe90Pm4GFdUP2agnMOaRsZol7An16bIAqHxzuzsSV1jCYPNEW7 TukHVSAryYBrq3Rb+/2CZ41YS9o6AlkV3g8QjWOAxxrBqs9hUStM5+UOgGe6vu6n7uNtmL V9oTQQ4EaSa1Kye+fdItkH+Xp+LDjxnveG/3XU7UZ3Ridd78g6cOj3PAT6STK/48MjVJni pB882cB8Jr1ULwIGIipHzCLP3sqNn14L6BBwRPjyx37qS4X8Miu8fXW/BZY9sXkaOps5af +9AXBj1Ga4cKEgM5XWnKOC3bEubCKztvUXrtQsy3CIxNRX9hoh3EMK0hutElOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1707427759; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ypzqz30zXAd6jJmaNjfZZ3vP9QqifNTTuq1Gw6w8dBs=; b=R5iJjJPgPGkY/H+qY+CdHXMbYsUt5FgBKnFauNqE0ehEozKC4F7ybEtdQXnMw3delO5BYw 1h5cMVIqVILo8tIPM2hxQNFeBMmL5FdzL0A3vC1HRvr6Xh+mba7eDUoH3lGtO5GopyqfgF LLTnWiWiwEeP/yUAO946IDhZmVkfbNtH00VUGPVer/p8B3WGX6N1igozSIgemuycIM7wIC 2h0QxlASLbPOIrSy7GFXA4nffgoRfEm8LtED1eGTkBaPQiMhRvCYp5TDas4lrj6ooaiTo/ /1QHP+Fnb/5Ty/NiCvAfnF50O0tn9M6jF8T+RUJN7SUSfIbh2+/KAzpYftcv+A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1707427759; a=rsa-sha256; cv=none; b=RYHl90JjJ92yp+kOECvxSLHcieSADdE9miLNP77T/GRc06RTKlIFcWvXCWrzmnsvxaneH1 AD5OvVrCZHydHy99bsE+zsSc1Cfq9ttFXUHUldpDbszXavYe47gVWVqq90rJap2ldTmJHj FUSL64zA/RdWtdx6WR3vSpfDO0w85kbivYUNGDvSV9YuATq/si906uED4/hoGjiXnMN2y4 p4fX+8tzTwe1ebfSvz9IaKby/4mD9IabufPZ5cMxTtvvNJSQEvoxvaGghaIIOSM2apgBWj H7lstQUaC02GgE2zrz1g3kCKMKxixzj6YASCBLFkO0KAjUIOIua03diUul+hDg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4TW99C15Kvz15bC; Thu, 8 Feb 2024 21:29:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 418LTJsN010415; Thu, 8 Feb 2024 21:29:19 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 418LTJ6w010412; Thu, 8 Feb 2024 21:29:19 GMT (envelope-from git) Date: Thu, 8 Feb 2024 21:29:19 GMT Message-Id: <202402082129.418LTJ6w010412@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Palle Girgensohn Subject: git: 22c09215c08f - main - security/vuxml: add issue for PostgreSQL List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: girgen X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 22c09215c08ff9ff04e5d6449bebab7638156aee Auto-Submitted: auto-generated The branch main has been updated by girgen: URL: https://cgit.FreeBSD.org/ports/commit/?id=22c09215c08ff9ff04e5d6449bebab7638156aee commit 22c09215c08ff9ff04e5d6449bebab7638156aee Author: Palle Girgensohn AuthorDate: 2024-02-08 17:19:42 +0000 Commit: Palle Girgensohn CommitDate: 2024-02-08 21:28:35 +0000 security/vuxml: add issue for PostgreSQL https://www.postgresql.org/support/security/CVE-2024-0985/ --- security/vuxml/vuln/2024.xml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 9851cfba660c..0407963b8561 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,42 @@ + + postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL + + + postgresql-server + 15.6 + 14.11 + 13.14 + 12.18 + + + + +

PostgreSQL Project reports:

+
+

+ One step of a concurrent refresh command was run under + weak security restrictions. If a materialized view's + owner could persuade a superuser or other + high-privileged user to perform a concurrent refresh on + that view, the view's owner could control code executed + with the privileges of the user running REFRESH. The fix + for the vulnerability makes is so that all + user-determined code is run as the view's owner, as + expected. +

+
+ + + + 2024-0985 + https://www.postgresql.org/support/security/CVE-2024-0985/ + + + 2024-02-08 + 2024-02-08 + + + Gitlab -- vulnerabilities