mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-08-21 18:03:22 +02:00
Due to simplistic quoting and confusion of database names with conninfo strings, roles with the CREATEDB or CREATEROLE option could escalate to superuser privileges when a superuser next ran certain maintenance commands. The new coding rule for PQconnectdbParams() calls, documented at conninfo_array_parse(), is to pass expand_dbname=true and wrap literal database names in a trivial connection string. Escape zero-length values in appendConnStrVal(). Back-patch to 9.1 (all supported versions). Nathan Bossart, Michael Paquier, and Noah Misch. Reviewed by Peter Eisentraut. Reported by Nathan Bossart. Security: CVE-2016-5424 |
||
---|---|---|
.. | ||
.gitignore | ||
check.c | ||
controldata.c | ||
dump.c | ||
exec.c | ||
file.c | ||
function.c | ||
IMPLEMENTATION | ||
info.c | ||
Makefile | ||
option.c | ||
parallel.c | ||
pg_upgrade.c | ||
pg_upgrade.h | ||
relfilenode.c | ||
server.c | ||
tablespace.c | ||
test.sh | ||
TESTING | ||
util.c | ||
version.c |