GNU bug report logs - #35698
[PATCH] gnu: postgresql: Replace with 10.8 [security fixes].

Previous Next

Package: guix-patches;

Reported by: Marius Bakke <mbakke <at> fastmail.com>

Date: Sun, 12 May 2019 12:27:01 UTC

Severity: normal

Tags: patch

Done: Marius Bakke <mbakke <at> fastmail.com>

Bug is archived. No further changes may be made.

Full log


View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Marius Bakke <mbakke <at> fastmail.com>
Subject: bug#35698: closed (Re: [bug#35698] [PATCH] gnu: postgresql:
 Replace with 10.8 [security fixes].)
Date: Sat, 25 May 2019 10:58:02 +0000
[Message part 1 (text/plain, inline)]
Your bug report

#35698: [PATCH] gnu: postgresql: Replace with 10.8 [security fixes].

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 35698 <at> debbugs.gnu.org.

-- 
35698: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=35698
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems
[Message part 2 (message/rfc822, inline)]
From: Marius Bakke <mbakke <at> fastmail.com>
To: 35698-done <at> debbugs.gnu.org
Subject: Re: [bug#35698] [PATCH] gnu: postgresql: Replace with 10.8 [security
 fixes].
Date: Sat, 25 May 2019 12:57:29 +0200
[Message part 3 (text/plain, inline)]
Marius Bakke <mbakke <at> fastmail.com> writes:

> This fixes CVE-2019-10129 and CVE-2019-10130.
>
> * gnu/packages/databases.scm (postgresql)[replacement]: New field.
> (postgresql-10.8): New variable.

I almost forgot this patch.

Pushed in a52c807a393ae0a9b59918a4f451c9e59ff7ec0e.
[signature.asc (application/pgp-signature, inline)]
[Message part 5 (message/rfc822, inline)]
From: Marius Bakke <mbakke <at> fastmail.com>
To: guix-patches <at> gnu.org
Subject: [PATCH] gnu: postgresql: Replace with 10.8 [security fixes].
Date: Sun, 12 May 2019 14:25:50 +0200
This fixes CVE-2019-10129 and CVE-2019-10130.

* gnu/packages/databases.scm (postgresql)[replacement]: New field.
(postgresql-10.8): New variable.
---
 gnu/packages/databases.scm | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index b632f05db4..295395f035 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -800,6 +800,7 @@ as a drop-in replacement of MySQL.")
   (package
     (name "postgresql")
     (version "10.7")
+    (replacement postgresql-10.8)
     (source (origin
               (method url-fetch)
               (uri (string-append "https://ftp.postgresql.org/pub/source/v"
@@ -842,6 +843,22 @@ TIMESTAMP.  It also supports storage of binary large objects, including
 pictures, sounds, or video.")
     (license (license:x11-style "file://COPYRIGHT"))))
 
+;; This release fixes CVE-2019-10129 and CVE-2019-10130.  See
+;; <https://www.postgresql.org/about/news/1939/> for details.
+;; TODO: Remove this in the next rebuild cycle.
+(define-public postgresql-10.8
+  (package
+    (inherit postgresql)
+    (version "10.8")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://ftp.postgresql.org/pub/source/v"
+                                  version "/postgresql-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "0pfdmy4w95b49w9rkn8dwvzmi2brpqfvbxd04y0k0s0xvymc565i"))
+              (patches (search-patches "postgresql-disable-resolve_symlinks.patch"))))))
+
 (define-public postgresql-9.6
   (package
     (inherit postgresql)
-- 
2.21.0




This bug report was last modified 6 years and 57 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.