mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-07-16 00:11:08 +02:00
681d9e4621
The two methods don't cooperate, so set_config_option("search_path",
...) has been ineffective under non-empty overrideStack. This defect
enabled an attacker having database-level CREATE privilege to execute
arbitrary code as the bootstrap superuser. While that particular attack
requires v13+ for the trusted extension attribute, other attacks are
feasible in all supported versions.
Standardize on the combination of NewGUCNestLevel() and
set_config_option("search_path", ...). It is newer than
PushOverrideSearchPath(), more-prevalent, and has no known
disadvantages. The "override" mechanism remains for now, for
compatibility with out-of-tree code. Users should update such code,
which likely suffers from the same sort of vulnerability closed here.
Back-patch to v11 (all supported versions).
Alexander Lakhin. Reported by Alexander Lakhin.
Security: CVE-2023-2454
46 lines
904 B
Makefile
46 lines
904 B
Makefile
# contrib/seg/Makefile
|
|
|
|
MODULE_big = seg
|
|
OBJS = \
|
|
$(WIN32RES) \
|
|
seg.o \
|
|
segparse.o \
|
|
segscan.o
|
|
|
|
EXTENSION = seg
|
|
DATA = seg--1.1.sql seg--1.1--1.2.sql seg--1.2--1.3.sql seg--1.3--1.4.sql \
|
|
seg--1.0--1.1.sql
|
|
PGFILEDESC = "seg - line segment data type"
|
|
|
|
HEADERS = segdata.h
|
|
|
|
REGRESS = security seg
|
|
|
|
EXTRA_CLEAN = y.tab.c y.tab.h
|
|
|
|
ifdef USE_PGXS
|
|
PG_CONFIG = pg_config
|
|
PGXS := $(shell $(PG_CONFIG) --pgxs)
|
|
include $(PGXS)
|
|
else
|
|
subdir = contrib/seg
|
|
top_builddir = ../..
|
|
include $(top_builddir)/src/Makefile.global
|
|
include $(top_srcdir)/contrib/contrib-global.mk
|
|
endif
|
|
|
|
|
|
# See notes in src/backend/parser/Makefile about the following two rules
|
|
segparse.h: segparse.c
|
|
touch $@
|
|
|
|
segparse.c: BISONFLAGS += -d
|
|
|
|
# Force these dependencies to be known even without dependency info built:
|
|
segparse.o segscan.o: segparse.h
|
|
|
|
distprep: segparse.c segscan.c
|
|
|
|
maintainer-clean:
|
|
rm -f segparse.h segparse.c segscan.c
|