pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Dean Rasheed <dean.a.rasheed@gmail.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: Amit Langote <Langote_Amit_f8@lab.ntt.co.jp>
Cc: Mario De Frutos Dieguez <mariodefrutos@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Fwd: Problem with a "complex" upsert
Date: Mon, 06 Aug 2018 12:41:21 -0400
Message-ID: <22577.1533573681@sss.pgh.pa.us> (raw)
In-Reply-To: <22581.1533422229@sss.pgh.pa.us>
References: <CAFYwGJ3Cpb2T+177rEopU7_aQE3W03UoqNZXdP5erCtSRgDGVA@mail.gmail.com>
	<18795.1529600753@sss.pgh.pa.us>
	<8da3739d-da24-1125-cab6-b68d6ec1bc6a@lab.ntt.co.jp>
	<30415.1531256373@sss.pgh.pa.us>
	<4b956567-8283-1b8a-7cd7-f8b6e626bba9@lab.ntt.co.jp>
	<CAEZATCWqLba_VVT1cdaT3YOijESRT8qewLN93Oc7H7ikW2fd-Q@mail.gmail.com>
	<CAEZATCUzdUerONYpaZ-YTVKOyzm1B-Ya9XzFXoMs0yrwJr0hkw@mail.gmail.com>
	<20180803184638.gdii7mja7qfc3fba@alap3.anarazel.de>
	<CAEZATCViZQcByymBpdWY2pXKHpvoX4ZN+G+KhAMEi=w3fwRnDA@mail.gmail.com>
	<7664.1533335577@sss.pgh.pa.us>
	<20180803224455.4g2hnvciynu2s7iv@alap3.anarazel.de>
	<8968.1533337119@sss.pgh.pa.us>
	<22581.1533422229@sss.pgh.pa.us>

I wrote:
> Attached is our finished patch against HEAD.  This is pretty much all
> Dean's work, but I'm posting it on his behalf because it's late in the UK
> and he's gone offline for the day.  In the interests of getting a
> full set of buildfarm testing on the patch before Monday's wrap deadline,
> I'm going to finish up back-porting the patch and push it tonight.

Final(?) note on this thread --- the security team realized over the
weekend that this bug constitutes a security issue, because you can do
more than crash the server.  We don't normally consider simple crashes
as being CVE-worthy problems, but in this case, there's potential for
datatype confusion, which can be leveraged to allow disclosure of server
memory (as we've seen in other bugs before).  We also realized that it's
possible to update a column you supposedly don't have privilege to update,
as long as there's some other column you do.

We've retroactively obtained a CVE number and will be describing this as
a security problem in the release notes.

			regards, tom lane




view thread (30+ messages)  latest in thread

Message-ID: <22577.1533573681@sss.pgh.pa.us>
Permalink:  ../22577.1533573681@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/22577.1533573681@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: tgl@sss.pgh.pa.us, dean.a.rasheed@gmail.com, andres@anarazel.de, Langote_Amit_f8@lab.ntt.co.jp, mariodefrutos@gmail.com, pgsql-bugs@lists.postgresql.org
  Subject: Re: Fwd: Problem with a "complex" upsert
  In-Reply-To: <22577.1533573681@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox