diff options
| author | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:09 -0800 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:12 -0800 |
| commit | 67029845b08d93108d53f572e2d58334c850126f (patch) | |
| tree | 180fecb50b9ca8ad1a74a968ed4e7285675e8aab /src/tutorial/syscat.source | |
| parent | c90c84b3f797a54a40ebc6795fbd743bdf44adad (diff) | |
| download | postgresql-67029845b08d93108d53f572e2d58334c850126f.tar.gz postgresql-67029845b08d93108d53f572e2d58334c850126f.zip | |
Ignore attempts to \gset into specially treated variables.
If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql. Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question. Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE". Back-patch to 9.5
(all supported versions).
Reviewed by Robert Haas. Reported by Nick Cleaton.
Security: CVE-2020-25696
Diffstat (limited to 'src/tutorial/syscat.source')
0 files changed, 0 insertions, 0 deletions