]> git.ipfire.org Git - thirdparty/postgresql.git/commit
projects / thirdparty / postgresql.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e568e1e) | patch
Require update permission for the large object written by lo_put().
authorTom Lane <tgl@sss.pgh.pa.us>
Mon, 7 Aug 2017 14:19:01 +0000 (10:19 -0400)
committerTom Lane <tgl@sss.pgh.pa.us>
Mon, 7 Aug 2017 14:19:19 +0000 (10:19 -0400)
commit8d9881911f0d30e0783a6bb1363b94a2c817433d
tree90d5c2e6f403433d8c308cd9fd524b499f74ad9ctree | snapshot
parente568e1eee4650227170cf8c64eedb74bafd7d1f0commit | diff
Require update permission for the large object written by lo_put().

lo_put() surely should require UPDATE permission, the same as lowrite(),
but it failed to check for that, as reported by Chapman Flack.  Oversight
in commit c50b7c09d; backpatch to 9.4 where that was introduced.

Tom Lane and Michael Paquier

Security: CVE-2017-7548
src/backend/libpq/be-fsstubs.c diff | blob | blame | history
src/test/regress/expected/privileges.out diff | blob | blame | history
src/test/regress/sql/privileges.sql diff | blob | blame | history
Mirror of https://git.postgresql.org/git/postgresql.git