postgres.git / summary / log / commit / refs

commit    bdd19e48a8c14e4e2a5edac7a6dc23de842ccdd6
Author:   Alvaro Herrera <alvherre@alvh.no-ip.org>
Date:     Mon Feb 10 14:47:09 2020 +0000
First released in: 13.0, 9.6.17, 10.12, 11.7, 12.2

    Fix priv checks for ALTER <object> DEPENDS ON EXTENSION
    
    Marking an object as dependant on an extension did not have any
    privilege check whatsoever; this allowed any user to mark objects as
    droppable by anyone able to DROP EXTENSION, which could be used to cause
    system-wide havoc.  Disallow by checking that the calling user owns the
    mentioned object.
    
    (No constraints are placed on the extension.)
    
    Security: CVE-2020-1720
    Reported-by: Tom Lane
    Discussion: 31605.1566429043@sss.pgh.pa.us


 src/backend/commands/alter.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/backend/commands/alter.c b/src/backend/commands/alter.c
index 4d443c13292..302f496b7d9 100644
--- a/src/backend/commands/alter.c
+++ b/src/backend/commands/alter.c
@@ -432,6 +432,17 @@ ExecAlterObjectDependsStmt(AlterObjectDependsStmt *stmt, ObjectAddress *refAddre
 		get_object_address_rv(stmt->objectType, stmt->relation, (List *) stmt->object,
 							  &rel, AccessExclusiveLock, false);
 
+	/*
+	 * Verify that the user is entitled to run the command.
+	 *
+	 * We don't check any privileges on the extension, because that's not
+	 * needed.  The object owner is stipulating, by running this command, that
+	 * the extension owner can drop the object whenever they feel like it,
+	 * which is not considered a problem.
+	 */
+	check_object_ownership(GetUserId(),
+						   stmt->objectType, address, stmt->object, rel);
+
 	/*
 	 * If a relation was involved, it would have been opened and locked. We
 	 * don't need the relation here, but we'll retain the lock until commit.


[parent: c59b0be9885b]