This bug was fixed in the package postgresql-14 - 14.24-0ubuntu0.22.04.1
---------------
postgresql-14 (14.24-0ubuntu0.22.04.1) jammy-security; urgency=medium
* New upstream version (LP: #2153489)
+ A dump/restore is not required for those running 14.X.
+ However, the first three security entries below describe configuration
adjustments and data cleanups that you may need to make after updating.
+ Also, if you use contrib/btree_gist or contrib/ltree, you may need to
reindex indexes made with those extensions; see the relevant entries
below.
+ Also, if you are upgrading from a version earlier than 14.19, see
those release notes as well please.
+ Restrict logical decoding output plugins to the set specified by a new
server parameter output_plugin_libraries
Previously, a replication user could select any loadable library for
logical decoding, allowing exploits of various sorts. To allow locking
this down without breaking setups that worked before, introduce a
whitelist of allowed output plugins.
By default, only the output plugins shipped as part of PostgreSQL
(pgoutput and test_decoding) are included in output_plugin_libraries.
Installations that rely on other output plugins must add them after
updating the server (CVE-2026-6471)
+ Fix contrib/pgcrypto's PGP encryption to detect unsupported
ciphers
Previously, if OpenSSL rejected the requested cipher (for example, because
it is running in FIPS mode, or the legacy provider hasn't been loaded),
pgcrypto failed to notice the failure and simply XOR'd the non-encrypted
block with the plaintext, rendering the “encryption” trivially breakable.
This will typically occur with deprecated or non-FIPS cipher algorithms
(cipher-algo=blowfish/bf, twofish, cast5, or 3des).
By default, pgcrypto will now fail to decrypt any messages that were
affected in this way. To allow retrieval of such data, a new option
ignore-cipher-failure has been added to pgp_pub_decrypt() and
pgp_sym_decrypt(). Setting ignore-cipher-failure=1 will restore their
previous behavior, allowing the faulty encryption wrapper to be stripped
off.
Once the affected messages are identified and stripped of their wrappers,
they can then be re-encrypted with a modern algorithm. It is important
however that the behavior of OpenSSL be the same as it was when the faulty
messages were created: if the set of unsupported algorithms is not the
same, this approach will not work. See the documentation for
ignore-cipher-failure. (CVE-2026-14663)
+ Fix psql to skip in-line data following a scripted COPY ... FROM STDIN
command, even if the COPY fails before sending PGRES_COPY_IN
Previously, if a COPY command failed at startup (for instance, because the
target table doesn't exist) psql would not realize that and would proceed
to read the following in-line data as SQL commands. In the best case
that's wrong and in the worst case it's a SQL-injection hazard. Teach psql
to recognize syntactically-valid COPY ... FROM STDIN commands and to skip
data on its own authority if the server doesn't respond with
PGRES_COPY_IN.
While this fix is unlikely to affect any production SQL scripts, test
scripts might intentionally exercise failing COPY ... FROM STDIN
commands. Those will need to gain a \. data terminator line after each
such command. (CVE-2026-6464)
+ Cross-check the output row type of a portal running EXECUTE or
FETCH
EXECUTE and FETCH use two portals: an outer one for the statement
itself, and an inner one running the query being executed on its behalf.
It was previously possible to make the declared row types of the two
portals diverge, leading to server memory disclosure and arbitrary code
execution. (CVE-2026-16239)
+ Fix buffer overrun with long time zone abbreviation in to_char()
This can easily crash the server, and exploits leading to arbitrary code
execution have been reported. (CVE-2026-14669)
+ Fix buffer overrun in regexp match/split functions
If passed invalidly-encoded data, these functions could write past the end
of their conversion buffer. (CVE-2026-14664)
+ Harden the ascii() function against invalid input
By supplying invalidly-encoded input, this function could be coaxed to
read and return a few bytes of data that it shouldn't. In assert-enabled
builds, its assertions could be triggered too. (CVE-2026-18024)
+ Fix multirange type handling in pg_restore_attribute_stats()
pg_restore_attribute_stats() treated multirange types just like their
underlying range type. This works correctly for the bounds histogram, but
it was wrong for all the other statistics kinds. (CVE-2026-16238)
+ Make scalarineqsel() check that a constant it expects to be of type tid
actually is
This expectation will hold for all the built-in operators that use this
estimator, but a maliciously-constructed operator could violate it,
leading to a crash or server memory disclosure. (CVE-2026-14668)
+ Harden tsvector and tsquery code against overly long values (both
individual lexemes and total vector/query length)
The documented limits were not enforced in all code paths.
(CVE-2026-14662)
+ Fix various places that mistakenly assumed they would not have to deal
with more than FUNC_MAX_ARGS function arguments
Notably, the server's actual limit on the number of arguments to an
aggregate function is FUNC_MAX_ARGS - 1, but the parser failed to enforce
that, creating hazards downstream. (CVE-2026-14679)
+ Reject calls from SQL to functions that take or return type
internal
The existing defenses against doing this have been shown to be
insufficient, so add more explicit checks. (CVE-2026-14680)
+ Preserve the ownership of extended statistics objects when they are
rebuilt by ALTER TABLE
Previously, the role running ALTER TABLE gained ownership of such objects,
but that seems inappropriate. (CVE-2026-6469)
+ When deparsing an EXTRACT() function call, quote the field name if
needed
The parser accepts any string literal as a field name in EXTRACT(),
deferring validation to execution. If the call is stored and deparsed (for
example during pg_dump), the string body was regurgitated verbatim,
allowing SQL injection. (CVE-2026-15741)
+ Check for USAGE privilege on data types in places that formerly failed
to check that
CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor did
commands that create stored expressions. These omissions allowed roles
without USAGE privilege to nonetheless create objects depending on the
type, possibly blocking the type's owner from changing the type later.
(CVE-2026-6470)
+ Invalidate role-dependent cached plans after role changes
Role membership, role attribute, and database ownership changes may impact
the expected behavior of row-level security policies, but previously we'd
continue to use cached plans that were made according to the old state of
affairs. (CVE-2026-14666)
+ Reject GSSEncRequest after direct SSL connection
After establishing a TLS-encrypted connection, the server would still
accept a request for GSSAPI encryption. If that succeeded, the connection
would proceed using TLS encryption, but it would look like a GSS
connection to the pg_hba rules. Thus, a pg_hba policy intending to
disallow TLS would not be enforced correctly. (CVE-2026-14681)
+ Make mock SCRAM authentication secrets more plausible
If a SCRAM login is attempted against a role that doesn't exist or doesn't
have a SCRAM secret, we generate a mock secret and carry out the
authentication handshake anyway, to avoid revealing these facts to an
attacker. But the mock secret was made with a fixed iteration count, which
in itself can be an observable response discrepancy. Use the configuration
setting scram_iterations instead, to make the mock secret look more like
the installation's real secrets. (CVE-2026-14672)
+ Fix out-of-bounds writes in ecpg applications caused by invalid bytea
data received from the server
ecpg assumed without checking that any bytea value must begin with \x. A
broken or malicious server might send a string shorter than 2 bytes,
resulting in memory clobber in the application. (CVE-2026-16241)
+ Do not do backquote expansion on the argument of psql's \unrestrict
command
This oversight in the fix for CVE-2025-8714 allows a malicious server to
inject shell commands into plain-text dump output that will be run at
restore time on the machine running psql, the exact scenario that
CVE-2025-8714 intended to prevent. (CVE-2026-18408)
+ Remove pg_dump's assumption that pg_proc.protrftypes cannot have more
than FUNC_MAX_ARGS entries
Since there could be entries for both input and output arguments, it's
feasible for this array's length to exceed FUNC_MAX_ARGS (which constrains
only input arguments). Even if that were not so, pg_dump cannot assume
that the server was built with the same value of FUNC_MAX_ARGS that it
has. An overrun would lead to a memory clobber inside pg_dump.
(CVE-2026-19385)
+ Harden PL/Perl against “tied” Perl arrays and hashes
A tied object that doesn't behave like a regular one could lead to memory
overwrite, or to constructing a corrupt result array (which would likely
cause problems later). (CVE-2026-14670)
+ Fix integer overflows in memory-allocation calculations in PL/Perl
and PL/Tcl
This is the same type of problem as CVE-2026-6473, just in a different
part of the code, and is fixed in the same way. (CVE-2026-14677)
+ Ensure that contrib/amcheck functions restrict search_path before
executing index expressions
Because amcheck will run such index expressions as the owner of their
tables, a caller could potentially hijack search_path-dependent
functions to run arbitrary code as the table owner. By default this is
not a vulnerability because only superusers are allowed to call amcheck
functions; but if that privilege was granted out, it created a larger
hazard than the documentation suggests. (CVE-2026-14673)
+ Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and
levenshtein_less_equal() functions
Passing large cost values to these functions could cause integer
overflows, thereby producing nonsensical results, and even causing
out-of-bounds writes in some cases. (CVE-2026-15742)
+ Fix buffer overrun in contrib/pg_stat_statements (Álvaro Herrera)
Query normalization didn't accurately account for the amount of space
the normalized string would require. (CVE-2026-14676)
+ Fix datatype error in contrib/pg_trgm's GiST picksplit function
This mistake resulted in reading past the end of the buffer, typically
causing bad split decisions; but a crash could ensue if you're very
unlucky. (CVE-2026-14678)
+ Remove the plan cache in contrib/refint
This caching behavior has several serious bugs, notably that
check_foreign_key() embeds the new key values in its cascade-UPDATE
queries, so a cached plan reuses the originally-needed values rather
than the key values that should be used. The simplest solution is to
remove it. (CVE-2026-14671)
+ Details about these and many further changes can be found at:
https://www.postgresql.org/docs/14/release-14-24.html.
* d/postgresql-14.NEWS: update NEWS file.
* d/p/extension_destdir: refresh patch.
-- Guilherme Puida Moreira <[email protected]> Thu, 13
Aug 2026 11:24:52 -0300
** Changed in: postgresql-14 (Ubuntu Jammy)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2153489
Title:
New PostgreSQL upstream microreleases 14.24, 16.15, and 18.6
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/postgresql-14/+bug/2153489/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
