Nathan Bossart 9cc2b62894 Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. ... The catalog view pg_stats_ext fails to consider privileges for expression statistics. The catalog view pg_stats_ext_exprs fails to consider privileges and row-level security policies. To fix, restrict the data in these views to table owners or roles that inherit privileges of the table owner. It may be possible to apply less restrictive privilege checks in some cases, but that is left as a future exercise. Furthermore, for pg_stats_ext_exprs, do not return data for tables with row-level security enabled, as is already done for pg_stats_ext. On the back-branches, a fix-CVE-2024-4317.sql script is provided that will install into the "share" directory. This file can be used to apply the fix to existing clusters. Bumps catversion on 'master' branch only. Reported-by: Lukas Fittl Reviewed-by: Noah Misch, Tomas Vondra, Tom Lane Security: CVE-2024-4317 Backpatch-through: 14		2024-05-06 09:00:13 -05:00
..
src	Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs.	2024-05-06 09:00:13 -05:00
KNOWN_BUGS
Makefile	Remove maintainer-check target, fold into normal build	2013-10-10 20:11:56 -04:00
MISSING_FEATURES
TODO	Change documentation references to PG website to use https: not http:	2017-05-20 21:50:47 -04:00