MIME-Version: 1.0
From: =?UTF-8?B?0JDQvdGC0L7QvSDQk9C70YPRiNCw0LrQvtCy?=
 <a.glushakov86@gmail.com>
Date: Mon, 18 Nov 2024 15:17:26 +0300
Message-ID: 
 <CAHnOmac-kzCxxm8OKa31FDJiyHRLgwbcs555_-HdeqhRJ6mEow@mail.gmail.com>
Subject: Broken behavior after minor update CVE-2024-10978
To: pgsql-admin@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000fb3a9206272ee7ec"
Archived-At: 
 <https://www.postgresql.org/message-id/CAHnOmac-kzCxxm8OKa31FDJiyHRLgwbcs555_-HdeqhRJ6mEow%40mail.gmail.com>
Precedence: bulk

--000000000000fb3a9206272ee7ec
Content-Type: text/plain; charset="UTF-8"

After upgrading to version 14.14, the behavior of roles related to the "set
role" option broke.
We actively use the feature "alter user <username> set role db_role"
in order to automatically change the role context upon login.
But now this behavior has changed, and the context does not change, which
unfortunately breaks all role-based access to data.

If this was an abnormal behavior, is there an alternative way to
automatically change the role context when connecting to the DB?

--000000000000fb3a9206272ee7ec
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">After upgrading to version 14.14, the behavior of roles re=
lated to the &quot;set role&quot; option broke.<br>We actively use the feat=
ure &quot;alter user &lt;username&gt; set role db_role&quot;<br>in order to=
 automatically change the role context upon login.<br><div></div><div>But n=
ow this behavior has changed, and the context does not change, which unfort=
unately breaks all role-based access to data.</div><br>If this was an abnor=
mal behavior, is there an alternative way to automatically change the role =
context when connecting to the DB?</div>

--000000000000fb3a9206272ee7ec--