From: Tom Lane <tgl@sss.pgh.pa.us>
To: Dean Rasheed <dean.a.rasheed@gmail.com>
cc: Andres Freund <andres@anarazel.de>,
        Amit Langote <Langote_Amit_f8@lab.ntt.co.jp>,
        Mario De Frutos Dieguez <mariodefrutos@gmail.com>,
        pgsql-bugs@lists.postgresql.org
Subject: Re: Fwd: Problem with a "complex" upsert
In-reply-to: <22581.1533422229@sss.pgh.pa.us>
References: 
 <CAFYwGJ3Cpb2T+177rEopU7_aQE3W03UoqNZXdP5erCtSRgDGVA@mail.gmail.com>
 <18795.1529600753@sss.pgh.pa.us>
 <8da3739d-da24-1125-cab6-b68d6ec1bc6a@lab.ntt.co.jp>
 <30415.1531256373@sss.pgh.pa.us>
 <4b956567-8283-1b8a-7cd7-f8b6e626bba9@lab.ntt.co.jp>
 <CAEZATCWqLba_VVT1cdaT3YOijESRT8qewLN93Oc7H7ikW2fd-Q@mail.gmail.com>
 <CAEZATCUzdUerONYpaZ-YTVKOyzm1B-Ya9XzFXoMs0yrwJr0hkw@mail.gmail.com>
 <20180803184638.gdii7mja7qfc3fba@alap3.anarazel.de>
 <CAEZATCViZQcByymBpdWY2pXKHpvoX4ZN+G+KhAMEi=w3fwRnDA@mail.gmail.com>
 <7664.1533335577@sss.pgh.pa.us>
 <20180803224455.4g2hnvciynu2s7iv@alap3.anarazel.de>
 <8968.1533337119@sss.pgh.pa.us> <22581.1533422229@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Sat, 04 Aug 2018 18:37:09 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <22576.1533573681.1@sss.pgh.pa.us>
Date: Mon, 06 Aug 2018 12:41:21 -0400
Message-ID: <22577.1533573681@sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Attached is our finished patch against HEAD.  This is pretty much all
> Dean's work, but I'm posting it on his behalf because it's late in the UK
> and he's gone offline for the day.  In the interests of getting a
> full set of buildfarm testing on the patch before Monday's wrap deadline,
> I'm going to finish up back-porting the patch and push it tonight.

Final(?) note on this thread --- the security team realized over the
weekend that this bug constitutes a security issue, because you can do
more than crash the server.  We don't normally consider simple crashes
as being CVE-worthy problems, but in this case, there's potential for
datatype confusion, which can be leveraged to allow disclosure of server
memory (as we've seen in other bugs before).  We also realized that it's
possible to update a column you supposedly don't have privilege to update,
as long as there's some other column you do.

We've retroactively obtained a CVE number and will be describing this as
a security problem in the release notes.

			regards, tom lane