From: Nathan Bossart <nathan@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Check for CREATE privilege on the schema in CREATE STATISTICS.
Date: Mon, 10 Nov 2025 15:01:06 +0000
Message-ID: <E1vITOE-005vv9-04@gemulon.postgresql.org> (raw)
Check for CREATE privilege on the schema in CREATE STATISTICS.
This omission allowed table owners to create statistics in any
schema, potentially leading to unexpected naming conflicts. For
ALTER TABLE commands that require re-creating statistics objects,
skip this check in case the user has since lost CREATE on the
schema. The addition of a second parameter to CreateStatistics()
breaks ABI compatibility, but we are unaware of any impacted
third-party code.
Reported-by: Jelte Fennema-Nio <postgres@jeltef.nl>
Author: Jelte Fennema-Nio <postgres@jeltef.nl>
Co-authored-by: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de>
Security: CVE-2025-12817
Backpatch-through: 13
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/00eb646ea43410e5df77fed96f4a981e66811796
Modified Files
--------------
src/backend/commands/statscmds.c | 17 ++++++++++++++-
src/backend/commands/tablecmds.c | 2 +-
src/backend/tcop/utility.c | 2 +-
src/include/commands/defrem.h | 2 +-
src/test/regress/expected/stats_ext.out | 37 +++++++++++++++++++++++++++++++++
src/test/regress/sql/stats_ext.sql | 34 ++++++++++++++++++++++++++++++
6 files changed, 90 insertions(+), 4 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: nathan@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Check for CREATE privilege on the schema in CREATE STATISTICS.
In-Reply-To: <E1vITOE-005vv9-04@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox