From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-committers@postgresql.org
Subject: pgsql: Convert newlines to spaces in names written in pg_dump comments.
Date: Thu, 23 Feb 2012 23:04:45 +0000
Message-ID: <E1S0hiP-00087k-V0@gemulon.postgresql.org> (raw)
Convert newlines to spaces in names written in pg_dump comments.
pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script. A name containing a newline
would at least render the script syntactically incorrect. Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.
Reported by Heikki Linnakangas, patch by Robert Haas
Security: CVE-2012-0868
Branch
------
master
Details
-------
http://git.postgresql.org/pg/commitdiff/89e0bac86dbca40dfc321926205f2a90d3da5437
Modified Files
--------------
src/bin/pg_dump/pg_backup_archiver.c | 60 +++++++++++++++++++++++++++++++--
1 files changed, 56 insertions(+), 4 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@sss.pgh.pa.us
Subject: Re: pgsql: Convert newlines to spaces in names written in pg_dump comments.
In-Reply-To: <E1S0hiP-00087k-V0@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox