| From: | Alvaro Herrera <alvherre(at)alvh(dot)no-ip(dot)org> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: Fix priv checks for ALTER <object> DEPENDS ON EXTENSION |
| Date: | 2020-02-10 15:07:37 |
| Message-ID: | E1j1Aev-0000dJ-Rb@gemulon.postgresql.org |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
Fix priv checks for ALTER <object> DEPENDS ON EXTENSION
Marking an object as dependant on an extension did not have any
privilege check whatsoever; this allowed any user to mark objects as
droppable by anyone able to DROP EXTENSION, which could be used to cause
system-wide havoc. Disallow by checking that the calling user owns the
mentioned object.
(No constraints are placed on the extension.)
Security: CVE-2020-1720
Reported-by: Tom Lane
Discussion: 31605(dot)1566429043(at)sss(dot)pgh(dot)pa(dot)us
Branch
------
REL9_6_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/e8b8eb937642f56725d4bc025ea7fa57caf6992c
Modified Files
--------------
src/backend/commands/alter.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Alvaro Herrera | 2020-02-10 15:17:59 | pgsql: createuser: fix parsing of --connection-limit argument |
| Previous Message | Peter Eisentraut | 2020-02-10 12:32:44 | pgsql: Translation updates |