From a8f53a907ba314addd1bc05ffd49346ab1bc85af Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sat, 17 May 2025 18:15:04 +0200 Subject: [PATCH] package/postgresql: security bump to version 17.5 Fixes the following security issue: CVE-2025-4207: PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. https://www.postgresql.org/about/news/postgresql-175-169-1513-1418-and-1321-released-3072/ Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain --- package/postgresql/postgresql.hash | 4 ++-- package/postgresql/postgresql.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/postgresql/postgresql.hash b/package/postgresql/postgresql.hash index 1c77119207..f17d4ca3ce 100644 --- a/package/postgresql/postgresql.hash +++ b/package/postgresql/postgresql.hash @@ -1,4 +1,4 @@ -# From https://ftp.postgresql.org/pub/source/v17.4/postgresql-17.4.tar.bz2.sha256 -sha256 c4605b73fea11963406699f949b966e5d173a7ee0ccaef8938dec0ca8a995fe7 postgresql-17.4.tar.bz2 +# From https://ftp.postgresql.org/pub/source/v17.5/postgresql-17.5.tar.bz2.sha256 +sha256 fcb7ab38e23b264d1902cb25e6adafb4525a6ebcbd015434aeef9eda80f528d8 postgresql-17.5.tar.bz2 # License file, Locally calculated sha256 e3822c4797fadcab31a3fc73f75c28ac20c73d72b565da91e9974cf9398ef4d2 COPYRIGHT diff --git a/package/postgresql/postgresql.mk b/package/postgresql/postgresql.mk index bffa544a5a..671bd30347 100644 --- a/package/postgresql/postgresql.mk +++ b/package/postgresql/postgresql.mk @@ -4,7 +4,7 @@ # ################################################################################ -POSTGRESQL_VERSION = 17.4 +POSTGRESQL_VERSION = 17.5 POSTGRESQL_SOURCE = postgresql-$(POSTGRESQL_VERSION).tar.bz2 POSTGRESQL_SITE = https://ftp.postgresql.org/pub/source/v$(POSTGRESQL_VERSION) POSTGRESQL_LICENSE = PostgreSQL