pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. 4+ messages / 1 participants [nested] [flat]
* pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. @ 2024-05-06 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Nathan Bossart @ 2024-05-06 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. The catalog view pg_stats_ext fails to consider privileges for expression statistics. The catalog view pg_stats_ext_exprs fails to consider privileges and row-level security policies. To fix, restrict the data in these views to table owners or roles that inherit privileges of the table owner. It may be possible to apply less restrictive privilege checks in some cases, but that is left as a future exercise. Furthermore, for pg_stats_ext_exprs, do not return data for tables with row-level security enabled, as is already done for pg_stats_ext. On the back-branches, a fix-CVE-2024-4317.sql script is provided that will install into the "share" directory. This file can be used to apply the fix to existing clusters. Bumps catversion on 'master' branch only. Reported-by: Lukas Fittl Reviewed-by: Noah Misch, Tomas Vondra, Tom Lane Security: CVE-2024-4317 Backpatch-through: 14 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/9cc2b62894de6a8b3d78d20bcd1a6647a7553a6c Modified Files -------------- doc/src/sgml/catalogs.sgml | 3 +- doc/src/sgml/system-views.sgml | 4 +- src/backend/catalog/Makefile | 3 +- src/backend/catalog/fix-CVE-2024-4317.sql | 117 ++++++++++++++++++++++++++++++ src/backend/catalog/system_views.sql | 11 +-- src/test/regress/expected/rules.out | 8 +- src/test/regress/expected/stats_ext.out | 43 +++++++++++ src/test/regress/sql/stats_ext.sql | 27 +++++++ 8 files changed, 199 insertions(+), 17 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. @ 2024-05-06 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Nathan Bossart @ 2024-05-06 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. The catalog view pg_stats_ext fails to consider privileges for expression statistics. The catalog view pg_stats_ext_exprs fails to consider privileges and row-level security policies. To fix, restrict the data in these views to table owners or roles that inherit privileges of the table owner. It may be possible to apply less restrictive privilege checks in some cases, but that is left as a future exercise. Furthermore, for pg_stats_ext_exprs, do not return data for tables with row-level security enabled, as is already done for pg_stats_ext. On the back-branches, a fix-CVE-2024-4317.sql script is provided that will install into the "share" directory. This file can be used to apply the fix to existing clusters. Bumps catversion on 'master' branch only. Reported-by: Lukas Fittl Reviewed-by: Noah Misch, Tomas Vondra, Tom Lane Security: CVE-2024-4317 Backpatch-through: 14 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/c3425383ba67ae6ecaddc8896025a91faadb430a Modified Files -------------- doc/src/sgml/catalogs.sgml | 7 +- src/backend/catalog/Makefile | 3 +- src/backend/catalog/fix-CVE-2024-4317.sql | 115 ++++++++++++++++++++++++++++++ src/backend/catalog/system_views.sql | 11 ++- src/test/regress/expected/rules.out | 8 +-- src/test/regress/expected/stats_ext.out | 43 +++++++++++ src/test/regress/sql/stats_ext.sql | 27 +++++++ 7 files changed, 197 insertions(+), 17 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. @ 2024-05-06 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Nathan Bossart @ 2024-05-06 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. The catalog view pg_stats_ext fails to consider privileges for expression statistics. The catalog view pg_stats_ext_exprs fails to consider privileges and row-level security policies. To fix, restrict the data in these views to table owners or roles that inherit privileges of the table owner. It may be possible to apply less restrictive privilege checks in some cases, but that is left as a future exercise. Furthermore, for pg_stats_ext_exprs, do not return data for tables with row-level security enabled, as is already done for pg_stats_ext. On the back-branches, a fix-CVE-2024-4317.sql script is provided that will install into the "share" directory. This file can be used to apply the fix to existing clusters. Bumps catversion on 'master' branch only. Reported-by: Lukas Fittl Reviewed-by: Noah Misch, Tomas Vondra, Tom Lane Security: CVE-2024-4317 Backpatch-through: 14 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/521a7156ab47623e299855dd04a2a4ea3ad71afe Modified Files -------------- doc/src/sgml/catalogs.sgml | 3 +-- doc/src/sgml/system-views.sgml | 4 +-- src/backend/catalog/system_views.sql | 11 +++------ src/include/catalog/catversion.h | 2 +- src/test/regress/expected/rules.out | 8 +++--- src/test/regress/expected/stats_ext.out | 43 +++++++++++++++++++++++++++++++++ src/test/regress/sql/stats_ext.sql | 27 +++++++++++++++++++++ 7 files changed, 81 insertions(+), 17 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. @ 2024-05-06 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 4+ messages in thread From: Nathan Bossart @ 2024-05-06 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. The catalog view pg_stats_ext fails to consider privileges for expression statistics. The catalog view pg_stats_ext_exprs fails to consider privileges and row-level security policies. To fix, restrict the data in these views to table owners or roles that inherit privileges of the table owner. It may be possible to apply less restrictive privilege checks in some cases, but that is left as a future exercise. Furthermore, for pg_stats_ext_exprs, do not return data for tables with row-level security enabled, as is already done for pg_stats_ext. On the back-branches, a fix-CVE-2024-4317.sql script is provided that will install into the "share" directory. This file can be used to apply the fix to existing clusters. Bumps catversion on 'master' branch only. Reported-by: Lukas Fittl Reviewed-by: Noah Misch, Tomas Vondra, Tom Lane Security: CVE-2024-4317 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/2485a85e96db137f7962a2e702b99869957f0990 Modified Files -------------- doc/src/sgml/catalogs.sgml | 3 +- doc/src/sgml/system-views.sgml | 4 +- src/backend/catalog/Makefile | 3 +- src/backend/catalog/fix-CVE-2024-4317.sql | 117 ++++++++++++++++++++++++++++++ src/backend/catalog/meson.build | 1 + src/backend/catalog/system_views.sql | 11 +-- src/test/regress/expected/rules.out | 8 +- src/test/regress/expected/stats_ext.out | 43 +++++++++++ src/test/regress/sql/stats_ext.sql | 27 +++++++ 9 files changed, 200 insertions(+), 17 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2024-05-06 14:00 UTC | newest] Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2024-05-06 14:00 pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. Nathan Bossart <nathan@postgresql.org> 2024-05-06 14:00 pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. Nathan Bossart <nathan@postgresql.org> 2024-05-06 14:00 pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. Nathan Bossart <nathan@postgresql.org> 2024-05-06 14:00 pgsql: Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. Nathan Bossart <nathan@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox