pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Ensure cached plans are correctly marked as dependent on role. 7+ messages / 1 participants [nested] [flat]
* pgsql: Ensure cached plans are correctly marked as dependent on role. @ 2024-11-11 15:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2024-11-11 15:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ensure cached plans are correctly marked as dependent on role. If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/cd7ab57532bb4fbf2e636b1f7d132e6e2d9ac5fc Modified Files -------------- src/backend/executor/functions.c | 6 ++ src/backend/rewrite/rewriteHandler.c | 67 ++++++++++++++++++-- src/test/regress/expected/rowsecurity.out | 100 ++++++++++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 58 +++++++++++++++++ src/tools/pgindent/typedefs.list | 1 + 5 files changed, 226 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ensure cached plans are correctly marked as dependent on role. @ 2024-11-11 15:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2024-11-11 15:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ensure cached plans are correctly marked as dependent on role. If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/edcda9bb4c4500b75bb4a16c7c59834398ca2906 Modified Files -------------- src/backend/executor/functions.c | 6 ++ src/backend/rewrite/rewriteHandler.c | 67 ++++++++++++++++++-- src/test/regress/expected/rowsecurity.out | 100 ++++++++++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 58 +++++++++++++++++ src/tools/pgindent/typedefs.list | 1 + 5 files changed, 226 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ensure cached plans are correctly marked as dependent on role. @ 2024-11-11 15:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2024-11-11 15:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ensure cached plans are correctly marked as dependent on role. If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/562289460e118fcad44ec916dcdab21e4763c38c Modified Files -------------- src/backend/executor/functions.c | 6 ++ src/backend/rewrite/rewriteHandler.c | 67 ++++++++++++++++++-- src/test/regress/expected/rowsecurity.out | 100 ++++++++++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 58 +++++++++++++++++ src/tools/pgindent/typedefs.list | 1 + 5 files changed, 226 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ensure cached plans are correctly marked as dependent on role. @ 2024-11-11 15:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2024-11-11 15:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ensure cached plans are correctly marked as dependent on role. If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/6db5ea8de8ce15897b706009aaf701d23bd65b23 Modified Files -------------- src/backend/executor/functions.c | 6 ++ src/backend/rewrite/rewriteHandler.c | 67 ++++++++++++++++++-- src/test/regress/expected/rowsecurity.out | 100 ++++++++++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 58 +++++++++++++++++ src/tools/pgindent/typedefs.list | 1 + 5 files changed, 226 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ensure cached plans are correctly marked as dependent on role. @ 2024-11-11 15:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2024-11-11 15:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ensure cached plans are correctly marked as dependent on role. If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4e51030af9e0a12d7fa06b73acd0c85024f81062 Modified Files -------------- src/backend/executor/functions.c | 6 +++ src/backend/rewrite/rewriteHandler.c | 67 +++++++++++++++++++++++--- src/test/regress/expected/rowsecurity.out | 78 +++++++++++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 44 +++++++++++++++++ src/tools/pgindent/typedefs.list | 1 + 5 files changed, 190 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ensure cached plans are correctly marked as dependent on role. @ 2024-11-11 15:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2024-11-11 15:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ensure cached plans are correctly marked as dependent on role. If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12 Branch ------ REL_13_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/952ff31e2a89e8ca79ecb12d61fddbeac3d89176 Modified Files -------------- src/backend/executor/functions.c | 6 +++ src/backend/rewrite/rewriteHandler.c | 67 +++++++++++++++++++++++--- src/test/regress/expected/rowsecurity.out | 78 +++++++++++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 44 +++++++++++++++++ src/tools/pgindent/typedefs.list | 1 + 5 files changed, 190 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Ensure cached plans are correctly marked as dependent on role. @ 2024-11-11 15:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2024-11-11 15:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Ensure cached plans are correctly marked as dependent on role. If a CTE, subquery, sublink, security invoker view, or coercion projection references a table with row-level security policies, we neglected to mark the plan as potentially dependent on which role is executing it. This could lead to later executions in the same session returning or hiding rows that should have been hidden or returned instead. Reported-by: Wolfgang Walther Reviewed-by: Noah Misch Security: CVE-2024-10976 Backpatch-through: 12 Branch ------ REL_12_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/448525e8a44080b6048e24f6942284b7eeae1a5c Modified Files -------------- src/backend/rewrite/rewriteHandler.c | 67 ++++++++++++++++++++++++++++--- src/test/regress/expected/rowsecurity.out | 58 ++++++++++++++++++++++++++ src/test/regress/sql/rowsecurity.sql | 33 +++++++++++++++ src/tools/pgindent/typedefs.list | 1 + 4 files changed, 153 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2024-11-11 15:00 UTC | newest] Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2024-11-11 15:00 pgsql: Ensure cached plans are correctly marked as dependent on role. Nathan Bossart <nathan@postgresql.org> 2024-11-11 15:00 pgsql: Ensure cached plans are correctly marked as dependent on role. Nathan Bossart <nathan@postgresql.org> 2024-11-11 15:00 pgsql: Ensure cached plans are correctly marked as dependent on role. Nathan Bossart <nathan@postgresql.org> 2024-11-11 15:00 pgsql: Ensure cached plans are correctly marked as dependent on role. Nathan Bossart <nathan@postgresql.org> 2024-11-11 15:00 pgsql: Ensure cached plans are correctly marked as dependent on role. Nathan Bossart <nathan@postgresql.org> 2024-11-11 15:00 pgsql: Ensure cached plans are correctly marked as dependent on role. Nathan Bossart <nathan@postgresql.org> 2024-11-11 15:00 pgsql: Ensure cached plans are correctly marked as dependent on role. Nathan Bossart <nathan@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox