diff options
| author | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:09 -0800 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:13 -0800 |
| commit | 43ebfea5a988582e9edc752cb1e22e929edac03b (patch) | |
| tree | 760c0a95f29bfe75cf1377207c7a5a8956e3d75e /contrib/postgres_fdw/connection.c | |
| parent | 5a55a80cc35da1e450f8d0fe22aa380e7fe68d64 (diff) | |
| download | postgresql-43ebfea5a988582e9edc752cb1e22e929edac03b.tar.gz postgresql-43ebfea5a988582e9edc752cb1e22e929edac03b.zip | |
In security-restricted operations, block enqueue of at-commit user code.
Specifically, this blocks DECLARE ... WITH HOLD and firing of deferred
triggers within index expressions and materialized view queries. An
attacker having permission to create non-temp objects in at least one
schema could execute arbitrary SQL functions under the identity of the
bootstrap superuser. One can work around the vulnerability by disabling
autovacuum and not manually running ANALYZE, CLUSTER, REINDEX, CREATE
INDEX, VACUUM FULL, or REFRESH MATERIALIZED VIEW. (Don't restore from
pg_dump, since it runs some of those commands.) Plain VACUUM (without
FULL) is safe, and all commands are fine when a trusted user owns the
target object. Performance may degrade quickly under this workaround,
however. Back-patch to 9.5 (all supported versions).
Reviewed by Robert Haas. Reported by Etienne Stalmans.
Security: CVE-2020-25695
Diffstat (limited to 'contrib/postgres_fdw/connection.c')
| -rw-r--r-- | contrib/postgres_fdw/connection.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/contrib/postgres_fdw/connection.c b/contrib/postgres_fdw/connection.c index 296830bd81b..fed14eb85d1 100644 --- a/contrib/postgres_fdw/connection.c +++ b/contrib/postgres_fdw/connection.c @@ -645,6 +645,10 @@ pgfdw_report_error(int elevel, PGresult *res, PGconn *conn, /* * pgfdw_xact_callback --- cleanup at main-transaction end. + * + * This runs just late enough that it must not enter user-defined code + * locally. (Entering such code on the remote side is fine. Its remote + * COMMIT TRANSACTION may run deferred triggers.) */ static void pgfdw_xact_callback(XactEvent event, void *arg) |