git.postgresql.org Git - postgresql.git/commit

git projects / postgresql.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c59b0be) | patch
Fix priv checks for ALTER <object> DEPENDS ON EXTENSION
2020年2月10日 14:47:09 +0000 (11:47 -0300)
2020年2月10日 14:47:09 +0000 (11:47 -0300)
commit bdd19e48a8c14e4e2a5edac7a6dc23de842ccdd6
Fix priv checks for ALTER <object> DEPENDS ON EXTENSION

Marking an object as dependant on an extension did not have any
privilege check whatsoever; this allowed any user to mark objects as
droppable by anyone able to DROP EXTENSION, which could be used to cause
system-wide havoc. Disallow by checking that the calling user owns the
mentioned object.

(No constraints are placed on the extension.)

Security: CVE-2020-1720
Reported-by: Tom Lane
Discussion: 31605.1566429043@sss.pgh.pa.us
src/backend/commands/alter.c diff | blob | blame | history
This is the main PostgreSQL git repository.
RSS Atom

AltStyle によって変換されたページ (->オリジナル) /