|
47 | 47 |
|
48 | 48 | <listitem> |
49 | 49 | <!-- |
| 50 | +Author: Heikki Linnakangas <heikki.linnakangas@iki.fi> |
| 51 | +Branch: master [5a9167c39] 2024-02-05 11:01:23 +0200 |
| 52 | +Branch: REL_16_STABLE [d6a61cb3b] 2024-02-05 11:02:56 +0200 |
| 53 | +Branch: REL_15_STABLE [f2fdea198] 2024-02-05 11:03:26 +0200 |
| 54 | +Branch: REL_14_STABLE [f4f288352] 2024-02-05 11:03:43 +0200 |
| 55 | +Branch: REL_13_STABLE [d541ce3b6] 2024-02-05 11:04:08 +0200 |
| 56 | +Branch: REL_12_STABLE [2699fc035] 2024-02-05 11:04:22 +0200 |
| 57 | +Branch: master [b96115acb] 2024-02-05 11:01:30 +0200 |
| 58 | +Branch: REL_16_STABLE [fb3836855] 2024-02-05 11:03:03 +0200 |
| 59 | +Branch: REL_15_STABLE [06f36bc01] 2024-02-05 11:03:28 +0200 |
| 60 | +Branch: REL_14_STABLE [a45c950ae] 2024-02-05 11:03:43 +0200 |
| 61 | +Branch: REL_13_STABLE [b73d21648] 2024-02-05 11:04:10 +0200 |
| 62 | +Branch: REL_12_STABLE [add8bc9b8] 2024-02-05 11:04:23 +0200 |
| 63 | +--> |
| 64 | + <para> |
| 65 | + Tighten security restrictions within <command>REFRESH MATERIALIZED |
| 66 | + VIEW CONCURRENTLY</command> (Heikki Linnakangas) |
| 67 | + </para> |
| 68 | + |
| 69 | + <para> |
| 70 | + One step of a concurrent refresh command was run under weak security |
| 71 | + restrictions. If a materialized view's owner could persuade a |
| 72 | + superuser or other high-privileged user to perform a concurrent |
| 73 | + refresh on that view, the view's owner could control code executed |
| 74 | + with the privileges of the user running <command>REFRESH</command>. |
| 75 | + Fix things so that all user-determined code is run as the view's |
| 76 | + owner, as expected. |
| 77 | + </para> |
| 78 | + |
| 79 | + <para> |
| 80 | + The only known exploit for this error does not work |
| 81 | + in <productname>PostgreSQL</productname> 16.0 and later, so it may |
| 82 | + be that v16 is not vulnerable in practice. |
| 83 | + </para> |
| 84 | + |
| 85 | + <para> |
| 86 | + The <productname>PostgreSQL</productname> Project thanks Pedro |
| 87 | + Gallegos for reporting this problem. |
| 88 | + (CVE-2024-0985) <!-- not CVE-2023-5869 as claimed in commit msg --> |
| 89 | + </para> |
| 90 | + </listitem> |
| 91 | + |
| 92 | + <listitem> |
| 93 | +<!-- |
50 | 94 | Author: Daniel Gustafsson <dgustafsson@postgresql.org> |
51 | 95 | Branch: master [9dce22033] 2023-09-27 13:02:21 +0200 |
52 | 96 | Branch: REL_16_STABLE [2cf50585e] 2023-11-17 10:18:38 +0100 |
|