Date: Thu, 21 Nov 2024 12:51:30 +0100
From: Christoph Berg <myon@debian.org>
To: Moritz =?iso-8859-1?Q?M=FChlenhoff?= <jmm@inutil.org>
Cc: Debian Security Team <team@security.debian.org>,
	PostgreSQL in Debian <pgsql-pkg-debian@lists.postgresql.org>
Subject: postgresql-15 (15.10-0+deb12u1) and a fix for CVE-2024-10978
Message-ID: <Zz8ewkTOHug5VdcT@msg.df7cb.de>
References: <ZrTK7iruFyVK7nIy@msg.df7cb.de>
 <ZrXWwoCWoxhAtGRl@pisco.westfalen.local>
 <Zzjl6LOGMZnB9MZu@msg.df7cb.de>
 <Zzj8cMUb4oxtl8js@inutil.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <Zzj8cMUb4oxtl8js@inutil.org>
Archived-At: 
 <https://www.postgresql.org/message-id/Zz8ewkTOHug5VdcT%40msg.df7cb.de>
Precedence: bulk

Re: Moritz Mühlenhoff
> Ok, no problem. We'll release that revised update via bookworm-security
> as well, then.

Hi,

new PG15 uploaded:

postgresql-15 (15.10-0+deb12u1) bookworm-security; urgency=medium

  * New upstream version 15.10.

    + Repair ABI break for extensions that work with struct ResultRelInfo

      Last week's minor releases unintentionally broke binary compatibility
      with timescaledb and several other extensions.  Restore the affected
      structure to its previous size, so that such extensions need not be
      rebuilt.

    + Restore functionality of ALTER {ROLE|DATABASE} SET role

      The fix for CVE-2024-10978 accidentally caused settings for role to not
      be applied if they come from non-interactive sources, including previous
      ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment variable.

 -- Christoph Berg <myon@debian.org>  Tue, 19 Nov 2024 15:36:12 +0100


Christoph