aboutsummaryrefslogtreecommitdiff
path: root/src/backend/utils/adt/jsonfuncs.c
diff options
context:
space:
mode:
authorNoah Misch <noah@leadboat.com>2020-08-10 09:22:54 -0700
committerNoah Misch <noah@leadboat.com>2020-08-10 09:22:59 -0700
commit5a936d64c84ddce2c0e0f2f1f9db2c1094c3ceb8 (patch)
tree39d590ab8e30cb5130d340e5b73bb9ad9172e479 /src/backend/utils/adt/jsonfuncs.c
parent7d6a41943b1d70bca066534440e8e0e800f11634 (diff)
downloadpostgresql-5a936d64c84ddce2c0e0f2f1f9db2c1094c3ceb8.tar.gz
postgresql-5a936d64c84ddce2c0e0f2f1f9db2c1094c3ceb8.zip
Empty search_path in logical replication apply worker and walsender.
This is like CVE-2018-1058 commit 582edc369cdbd348d68441fc50fa26a84afd0c1a. Today, a malicious user of a publisher or subscriber database can invoke arbitrary SQL functions under an identity running replication, often a superuser. This fix may cause "does not exist" or "no schema has been selected to create in" errors in a replication process. After upgrading, consider watching server logs for these errors. Objects accruing schema qualification in the wake of the earlier commit are unlikely to need further correction. Back-patch to v10, which introduced logical replication. Security: CVE-2020-14349
Diffstat (limited to 'src/backend/utils/adt/jsonfuncs.c')
0 files changed, 0 insertions, 0 deletions