The PostgreSQL Global Development Group has released an update to all

supported versions of our database system, including 12.4, 11.9, 10.14,
9.6.19, and 9.5.23.

This release closes two security vulnerabilities and fixes over 50 bugs
reported over the last three months.

Please plan to update at your earliest convenience.

Security Issues
---------------

* CVE-2020-14349: Uncontrolled search path element in logical replication.

Versions Affected: 10 - 12.

The PostgreSQL `search_path` setting determines schemas searched for
tables, functions, operators, etc. The CVE-2018-1058 fix caused most
PostgreSQL-provided client applications to sanitize `search_path`, but
logical replication continued to leave `search_path` unchanged. Users of
a replication publisher or subscriber database can create objects in the
`public` schema and harness them to execute arbitrary SQL functions
under the identity running replication, often a superuser. Installations
having adopted a documented secure schema usage pattern are not vulnerable.

The PostgreSQL project thanks Noah Misch for reporting this problem.

* CVE-2020-14350: Uncontrolled search path element in `CREATE EXTENSION`.

Versions Affected: 9.5 - 12. The security team typically does not test
unsupported versions, but this problem is quite old.

When a superuser runs certain `CREATE EXTENSION` statements, users may
be able to execute arbitrary SQL functions under the identity of that
superuser. The attacker must have permission to create objects in the
new extension's schema or a schema of a prerequisite extension.  Not all
extensions are vulnerable.

In addition to correcting the extensions provided with PostgreSQL, the
PostgreSQL Global Development Group is issuing guidance for third-party
extension authors to secure their own work.

The PostgreSQL project thanks Andres Freund for reporting this problem.

Security:	CVE-2020-14349, CVE-2020-14350

4 files changed, 8 insertions, 5 deletions

diff --git a/databases/postgresql12-server/Makefile b/databases/postgresql12-server/Makefile
index 5f968888024e..be1f5f5897d7 100644
--- a/databases/postgresql12-server/Makefile
+++ b/databases/postgresql12-server/Makefile
@@ -2,7 +2,7 @@
 # $FreeBSD$
 
 PORTNAME?=	postgresql
-DISTVERSION?=	12.3
+DISTVERSION?=	12.4
 # PORTREVISION must be ?= otherwise, all slave ports get this PORTREVISION and
 # not their own.  Probably best to keep it at ?=0 when reset here too.
 PORTREVISION?=	0
diff --git a/databases/postgresql12-server/distinfo b/databases/postgresql12-server/distinfo
index 38a554dc813c..1d3c6e4e2462 100644
--- a/databases/postgresql12-server/distinfo
+++ b/databases/postgresql12-server/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1589458709
-SHA256 (postgresql/postgresql-12.3.tar.bz2) = 94ed64a6179048190695c86ec707cc25d016056ce10fc9d229267d9a8f1dcf41
-SIZE (postgresql/postgresql-12.3.tar.bz2) = 20439892
+TIMESTAMP = 1597309874
+SHA256 (postgresql/postgresql-12.4.tar.bz2) = bee93fbe2c32f59419cb162bcc0145c58da9a8644ee154a30b9a5ce47de606cc
+SIZE (postgresql/postgresql-12.4.tar.bz2) = 20669776
diff --git a/databases/postgresql12-server/pkg-plist-client b/databases/postgresql12-server/pkg-plist-client
index 11d5e6227a0d..50e18f349224 100644
--- a/databases/postgresql12-server/pkg-plist-client
+++ b/databases/postgresql12-server/pkg-plist-client
@@ -299,6 +299,7 @@ include/postgresql/server/commands/variable.h
 include/postgresql/server/commands/view.h
 include/postgresql/server/common/base64.h
 include/postgresql/server/common/config_info.h
+include/postgresql/server/common/connect.h
 include/postgresql/server/common/controldata_utils.h
 include/postgresql/server/common/fe_memutils.h
 include/postgresql/server/common/file_perm.h
diff --git a/databases/postgresql12-server/pkg-plist-server b/databases/postgresql12-server/pkg-plist-server
index fb320a38603c..0295b878c699 100644
--- a/databases/postgresql12-server/pkg-plist-server
+++ b/databases/postgresql12-server/pkg-plist-server
@@ -847,6 +847,7 @@ lib/libpgcommon.a
 %%NLS%%share/locale/sv/LC_MESSAGES/pg_archivecleanup-12.mo
 %%NLS%%share/locale/sv/LC_MESSAGES/pg_basebackup-12.mo
 %%NLS%%share/locale/sv/LC_MESSAGES/pg_checksums-12.mo
+%%DATADIR%%/snowball_create.sql
 %%NLS%%share/locale/sv/LC_MESSAGES/pg_controldata-12.mo
 %%NLS%%share/locale/sv/LC_MESSAGES/pg_ctl-12.mo
 %%NLS%%share/locale/sv/LC_MESSAGES/pg_resetwal-12.mo
@@ -883,6 +884,7 @@ lib/libpgcommon.a
 %%NLS%%share/locale/uk/LC_MESSAGES/pg_test_timing-12.mo
 %%NLS%%share/locale/uk/LC_MESSAGES/pg_waldump-12.mo
 %%NLS%%share/locale/uk/LC_MESSAGES/plpgsql-12.mo
+%%NLS%%share/locale/uk/LC_MESSAGES/postgres-12.mo
 %%NLS%%share/locale/vi/LC_MESSAGES/pg_controldata-12.mo
 %%NLS%%share/locale/vi/LC_MESSAGES/pg_test_fsync-12.mo
 %%NLS%%share/locale/vi/LC_MESSAGES/pg_test_timing-12.mo
@@ -890,6 +892,7 @@ lib/libpgcommon.a
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/initdb-12.mo
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/pg_archivecleanup-12.mo
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/pg_basebackup-12.mo
+%%NLS%%share/locale/zh_CN/LC_MESSAGES/pg_checksums-12.mo
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/pg_controldata-12.mo
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/pg_ctl-12.mo
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/pg_resetwal-12.mo
@@ -900,7 +903,6 @@ lib/libpgcommon.a
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/pg_waldump-12.mo 
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/plpgsql-12.mo
 %%NLS%%share/locale/zh_CN/LC_MESSAGES/postgres-12.mo
-%%DATADIR%%/snowball_create.sql
 %%TZDATA%%%%DATADIR%%/timezone/Africa/Abidjan
 %%TZDATA%%%%DATADIR%%/timezone/Africa/Accra
 %%TZDATA%%%%DATADIR%%/timezone/Africa/Addis_Ababa