Subject: Broken behavior after minor update CVE-2024-10978

From: Антон Глушаков<[email-masked]>
Date: Mon, 18 Nov 2024 15:17:26 +0300

After upgrading to version 14.14, the behavior of roles related to the "set
role" option broke.
We actively use the feature "alter user <username> set role db_role"
in order to automatically change the role context upon login.
But now this behavior has changed, and the context does not change, which
unfortunately breaks all role-based access to data.

If this was an abnormal behavior, is there an alternative way to
automatically change the role context when connecting to the DB?

---

From: "David G. Johnston" <[email-masked]>
Date: Tue, 19 Nov 2024 08:31:28 -0700

On Tue, Nov 19, 2024 at 8:26 AM Антон Глушаков <[email-masked]>
wrote:

> After upgrading to version 14.14, the behavior of roles related to the
> "set role" option broke.
>

Correct.  A proper bug report was already filed and this has been fixed in
this week's out-of-band update.

David J.