mirror of https://github.com/openwrt/packages.git
15b06ce6e3
Security release from 18.4 (18.5 was never released, pulled post-wrap due to a regression). A dump/restore is not required for those running 18.x, but see the migration notes below for the first three security fixes, GIN index reltuples corruption, and btree_gist/ltree reindexing. - restrict logical decoding output plugins to a new output_plugin_libraries allowlist; previously a replication user could load any library for logical decoding (CVE-2026-6471) - fix contrib/pgcrypto PGP encryption to detect unsupported ciphers; previously an OpenSSL cipher rejection (e.g. FIPS mode) was ignored and pgcrypto silently XORed plaintext instead of encrypting it (CVE-2026-14663) - fix psql to skip in-line data following a scripted "COPY ... FROM STDIN" even when the COPY fails before PGRES_COPY_IN, closing a SQL-injection hazard in scripts that exercise failing COPY commands (CVE-2026-6464) - cross-check the output row type of a portal running EXECUTE/FETCH; divergent declared row types between the outer and inner portal could lead to server memory disclosure and arbitrary code execution (CVE-2026-16239) - fix a buffer overrun with a long time zone abbreviation in to_char(), which could crash the server or be exploited for arbitrary code execution (CVE-2026-14669) Plus a variety of other fixes from 18.4; see the upstream release notes for the complete list. Signed-off-by: Daniel Golle <daniel@makrotopia.org> |
||
|---|---|---|
| .. | ||
| files | ||
| patches | ||
| Makefile | ||