Beside other bugfixes, it contains fixes for CVE-2025-12817 and CVE-2025-12818.
Release notes: https://www.postgresql.org/docs/release/14.20/
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
The version don't match and only the Jenkins plugin is affected.
Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 524acf0542cafed3f5e82cd94291a653f6cf86e1)
Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE))
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Vulnerability in the MySQL Client product of Oracle MySQL (component:
Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.41,
8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows low
privileged attacker with network access via multiple protocols to compromise
MySQL Client. Successful attacks of this vulnerability can result in
unauthorized access to critical data or complete access to all MySQL Client
accessible data as well as unauthorized update, insert or delete access to
some of MySQL Client accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality
and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).
Reference:
https://security-tracker.debian.org/tracker/CVE-2025-30722
Upstream-patch:
6aa860be27
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).
Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior
and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged
attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-21490https://security-tracker.debian.org/tracker/CVE-2025-21490
Upstream-patch:
82310f926b
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Vulnerability in the MySQL Server product of Oracle MySQL (component:
Client: mysqldump). Supported versions that are affected are 8.0.36
and prior and 8.3.0 and prior. Difficult to exploit vulnerability
allows unauthenticated attacker with logon to the infrastructure
where MySQL Server executes to compromise MySQL Server. Successful
attacks of this vulnerability can result in unauthorized update,
insert or delete access to some of MySQL Server accessible data as
well as unauthorized read access to a subset of MySQL Server accessible
data and unauthorized ability to cause a partial denial of service
(partial DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Confidentiality,
Integrity and Availability impacts).
CVE-2024-21096-0001, CVE-2024-21096-0002 are CVE fixes and rest are
regression fixes.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-21096https://security-tracker.debian.org/tracker/CVE-2024-21096
Upstream patches:
13663cb5c41c425a8d8577c4c0f256d60f5c11ead20518168a
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2023-52969:
MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7
through 10.11., and 11.0 through 11.0. can sometimes crash
with an empty backtrace log. This may be related to
make_aggr_tables_info and optimize_stage2.
CVE-2023-52970:
MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7
through 10.11., 11.0 through 11.0., and 11.1 through 11.4.*
crashes in Item_direct_view_ref::derived_field_transformer_for_where.
CVE-2023-52969-CVE-20230-52970-0001 and CVE-2023-52969-CVE-20230-52970-0002
are dependent commits while CVE-2023-52969-CVE-20230-52970-0003 and
CVE-2023-52969-CVE-20230-52970-0004 are actual CVE fixes.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-52969https://nvd.nist.gov/vuln/detail/CVE-2023-52970
Upstream patches:
e640373389https://github.com/MariaDB/server/commit/d98ac8511e39770ef3d8b42937c84e876d1459e9b313d2de14fc9dc84b0
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6
before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before
11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under
mysql_derived_prepare when derived is not yet prepared, leading
to a find_field_in_table crash.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-52968
Upstream patch:
74883f5e2f
Fix indent issue in mariadb.inc file.
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
License-Update: Update license year to 2025
Includes fix for CVE-2025-1094
Changelog:
https://www.postgresql.org/docs/release/14.17/
Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch for
14.17
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Includes fix for CVE-2024-10976, CVE-2024-10977, CVE-2024-10978
and CVE-2024-10979
Changelog:
https://www.postgresql.org/docs/release/14.14/
0001-configure.ac-bypass-autoconf-2.69-version-check.patch
refreshed for 14.14
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Addresses CVEs CVE-2024-4317 & CVE-2024-7348 and other bug fixes.
Release notes are available at:
https://www.postgresql.org/docs/release/14.13/https://www.postgresql.org/docs/release/14.12/
0001-configure.ac-bypass-autoconf-2.69-version-check.patch
refreshed for new version.
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Addresses CVEs and other bug fixes. Remove patches that are fixed
in this release. Release notes are available at:
https://www.postgresql.org/docs/release/14.10/https://www.postgresql.org/docs/release/14.11/
0001-configure.ac-bypass-autoconf-2.69-version-check.patch
refreshed for new version.
License-Update: Copyright year updated
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Vulnerability in the MySQL Server product of Oracle MySQL
(component: InnoDB). Supported versions that are affected
are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily
exploitable vulnerability allows high privileged attacker
with network access via multiple protocols to compromise
MySQL Server. Successful attacks of this vulnerability can
result in unauthorized ability to cause a hang or frequently
repeatable crash (complete DOS) of MySQL Server. CVSS 3.1
Base Score 4.9 (Availability impacts).
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-22084https://security-tracker.debian.org/tracker/CVE-2023-22084
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
In postgresql sysview ptest are failing due to hidden debug info in pg_config table.
The information is hidden due to existing patch 0001-config_info.c-not-expose-build-info.patch
So for passing the test we need to reduce the row count in the sysviews test.
Also for test results to be shown as pass we need to reduce the row count for
the expected count in the sysviews.out file.
Signed-off-by: Manoj Saun <manojsingh.saun@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
base is always inherited so remove this code which will soon cause an error.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a755af4fb5ca2e158b00214bb18e27ba69c200fd)
Signed-off-by: Ming Liu <liu.ming50@gmail.com>
The patch for removing 'QA issues' with pg_config was incomplete, it did not
change the number of items supposed to be in the configdata stucture. This leads to
get_configdata function asserting, and pg_config command does not work
Signed-off-by: Steffen Olsen <steffen.olsen@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 730c85613ec718919bc0d155addfb9a20af112ad)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Setting soname in LDFLAGS means that the extra mdb tools also
incorrectly get soname set. This then triggers package.bbclass to add a
duplicate shlib_provider in /usr/bin for liblmdb.so.0.9.29. Then any
other recipe depending on liblmdb is going to get a 'Multiple shlib
provider' error.
shlibs2/lmdb.list before:
liblmdb.so.0.9.29:/usr/bin:0.9.29
liblmdb.so.0.9.29:/usr/lib:0.9.29
shlibs2/lmdb.list after:
liblmdb.so.0.9.29:/usr/lib:0.9.29
Signed-off-by: Justin Bronder <jsbronder@cold-front.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2017-8806 doesn't apply to out configuration of postgresql so we
can safely ignore it.
Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit de4097f2304b2031265173c7d09aa1a2e983b81c)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Rework the patch to fix the build failure with bundled openssl and
the missing part [1] already included in mariadb 10.8.x [2].
Add PACKAGECONFIG:remove:pn-mariadb = " openssl" to local.conf
$ bitbake mariadb
| /buildpath/mariadb/10.7.3-r0/mariadb-10.7.3/mysys_ssl/my_crypt.cc:18:
| /buildpath/mariadb/10.7.3-r0/mariadb-10.7.3/mysys_ssl/my_crypt.cc: In member function 'virtual int MyCTX_nopad::init(const EVP_CIPHER*, int, const uchar*, uint, const uchar*, uint)':
| /buildpath/mariadb/10.7.3-r0/mariadb-10.7.3/include/my_global.h:387:74: error: narrowing conversion of '-1' from 'int' to 'long unsigned int' [-Wnarrowing]
387 | typedef char compile_time_assert[(X) ? 1 : -1] _attribute_((unused)); \
[1] 7cd965af92
[2] d42c2efbaa
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
clang complains about alignments on 64bit atomics and falls back to
using these functions from libatomic. And the configure part does not
detect this condition and thinks that system can support 64bit atomics
just fine.
clang needs this patch to fix
| pfs_instr.cc:(.text+0x10a5): undefined reference to `__atomic_fetch_add_8'
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Mingli Yu <mingli.yu@windriver.com>
cmakery fails to detect openSSL and falls back to use wolfSSL which is
bundled with mariadb, therefore fix openSSL support fixes from fedora
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Mingli Yu <mingli.yu@windriver.com>
Remove two patches which are already included in new version and rebase
one patch to new version and add lzo rdepends to fix below qa issue. [1]
ERROR: mariadb-10.7.3-r0 do_package_qa: QA Issue: /usr/lib64/plugin/provider_lzo.so contained in package mariadb-server requires liblzo2.so.2()(64bit), but no providers found in RDEPENDS:mariadb-server? [file-rdeps]
Add gnutls to depends to fix below error and fmt to depends [2]
| Could NOT find GnuTLS (missing: GNUTLS_LIBRARY GNUTLS_INCLUDE_DIR)
[1] bf8b699f64
[2] 284ed64336
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
0001-Fix-build-when-SIGSTKSZ-is-no-longer-a-constant.patch
removed since it's included in 4.0.3
Version 4.0.3 differs from 4.0.2 in the following ways:
========================================================
Changes affecting all or multiple backends:
- Fix opening sessions from pool (#891).
- Fix default backend search path (#928).
- Fix build with latest glibc versions where SIGSTKSZ is not constant (#886).
- Document using SOCI as a CMake subdirectory (#925).
- Document using SOCI with Conan (#877).
Backend-specific changes:
- MySQL
- Implement get_table_names() for MySQL (#927).
- Fix MySQL backend build with MySQL >= 8 (#884).
- Fix mysql_library_end() in multithreaded environment (#909).
- Make mysql_soci_error::get_error_category() more useful (#902).
- ODBC
- Fix several bugs in vector into code (#888, #892).
- Fix memory leaks in case of SQLNumResultCols() failure.
- Export odbc_session_backend::get_database_product() from DLL.
- Oracle
- Add support for detecting Oracle 20 and 21 to CMake (#896).
- PostgreSQL
- Fix compilation when "free" is redefined somewhere else.
- SQLite3
- Fix bulk operations with vectors of size 1 in SQLite3 backend (#908).
- Firebird
- Suppress FB memory leaks
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
