-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 08 Jul 2026 18:12:26 +0200
Source: pgextwlist
Binary: postgresql-17-pgextwlist postgresql-17-pgextwlist-dbgsym
Architecture: s390x
Version: 1.19-1+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: s390x Build Daemon (ziehrer) <buildd_s390x-ziehrer@buildd.debian.org>
Changed-By: Christoph Berg <myon@debian.org>
Description:
 postgresql-17-pgextwlist - PostgreSQL Extension Whitelisting
Changes:
 pgextwlist (1.19-1+deb13u1) trixie-security; urgency=medium
 .
   * Reject substituting extension schemas or owners matching ["$'\].
 .
     The extwlist.custom_path script mechanism was vulnerable to SQL
     injection via crafted schema and user names. The same problem was fixed
     in August 2023 in PostgreSQL (cd5f2a3570), and is now fixed in
     pgextwlist as well. Substitutions that attempt to insert any of "$'\ are
     now simply rejected. (We don't try to quote the values as we don't know
     which quoting context we are in.)
 .
     CVE-2023-39417
Checksums-Sha1:
 4b769f74c784e4ac6fd15925c9fa214b14309dac 9320 pgextwlist_1.19-1+deb13u1_s390x-buildd.buildinfo
 a26add3fb7fa4893ce444d3366518e5c4663f762 57584 postgresql-17-pgextwlist-dbgsym_1.19-1+deb13u1_s390x.deb
 b1daf529781b092ca12e9ee32f0af98f0ed16c3d 31364 postgresql-17-pgextwlist_1.19-1+deb13u1_s390x.deb
Checksums-Sha256:
 8369307858c0c47628ad0630c90d53997cf3ab49f1da716c23ab297bbc799961 9320 pgextwlist_1.19-1+deb13u1_s390x-buildd.buildinfo
 d598c7ecec04a2a4a4c00aad3a3a3b852506c0308b4e81672ecd50035c098d0d 57584 postgresql-17-pgextwlist-dbgsym_1.19-1+deb13u1_s390x.deb
 23f069031687408ebe43b2ade9e09ccd67df61bcb02ac3d37a2a45e59377ac10 31364 postgresql-17-pgextwlist_1.19-1+deb13u1_s390x.deb
Files:
 c7526d9519d54c3104b71c6113d704d7 9320 database optional pgextwlist_1.19-1+deb13u1_s390x-buildd.buildinfo
 b644925ea45d3fa38e97f0962da7bb2e 57584 debug optional postgresql-17-pgextwlist-dbgsym_1.19-1+deb13u1_s390x.deb
 f020743b90117015695a780c5e046b6a 31364 libs optional postgresql-17-pgextwlist_1.19-1+deb13u1_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmpOkegACgkQMWUFebkH
noQlghAAmErXO97Dhw+ycUmXgjKxyxahrbJdvFB2+5/FFKWt+U/zsjxzEScw+oev
MgriR/u1pMmCyhYaeklllvtIOa3ZEoy0NgaiHhxdEeqCWg1vkdBHjHNKJKq9uEHm
0p5u2H3KY/JbUb3ABH8Ap8ALaSdqYoIjy1bS3OkGYLZO78F7ZjfRsdKGFx6JK1bp
Kg2nrCyPQRLvfSj5fGUISAyktp09ce4LJS+smwVOCoAQJx2dpTbZu59Ab9427IfH
v3YW2KeZxVbtvG15EU25mrabpAxUzCOHn4yi+gQWpR6x8tyio0S651gML70IhtUt
MonxYmCB/NyI2bmEwPcyvB10amVGu746rwVS7QkrXxnuHHiFUS2JumNFNba4nmsY
dGEUFZQFzBLqPjQVtJIz9ges7m0qcL/Kb8Mrj7qBbNH0gjkpNKlhudNYjvE4uSfB
o3DoqzbQAsm1bsyHl/3AWpFVtvzd50rT91bUo5GueKnuRPcXpwmxcLC3/TEkkJE3
GxMLzePZWbHGu3jCF81jQnHS05NWNrh1gHfrf6kZ8OQGcG3bJKIr8Msl6ARvmd3i
HWDdG883e+pVaMOj9dB+fVuuap4lWe6K/SBX2porg6mEQsyfNJ/iap8R95x8ymvL
yhRh69jvu0SvVkjPfCZkgYas7KaHCHf+iprcbAXBhoNfPlLy3ks=
=WxmI
-----END PGP SIGNATURE-----