This is the main PostgreSQL git repository. http://git.postgresql.org/cgit/postgresql.git/atom?h=REL7_4_STABLE 2010-10-01T13:40:30Z 2010-10-01T13:40:30Z Marc G. Fournier 2010-10-01T13:40:30Z urn:sha1:fd7fdbc88be20f5fc8789254b18902116f88b5fe 2010-09-30T21:23:01Z Tom Lane 2010-09-30T21:23:01Z urn:sha1:b68319c25bb40dd0245cf176273c741fdba064ec There are numerous methods by which a Perl or Tcl function can subvert the behavior of another such function executed later; for example, by redefining standard functions or operators called by the target function. If the target function is SECURITY DEFINER, or is called by such a function, this means that any ordinary SQL user with Perl or Tcl language usage rights can do essentially anything with the privileges of the target function's owner. To close this security hole, create a separate Perl or Tcl interpreter for each SQL userid under which plperl or pltcl functions are executed within a session. However, all plperlu or pltclu functions run within a session still share a single interpreter, since they all execute at the trust level of a database superuser anyway. Note: this change results in a functionality loss when libperl has been built without the "multiplicity" option: it's no longer possible to call plperl functions under different userids in one session, since such a libperl can't support multiple interpreters in one process. However, such a libperl already failed to support concurrent use of plperl and plperlu, so it's likely that few people use such versions with Postgres. Security: CVE-2010-3433 2010-09-30T19:10:51Z Peter Eisentraut 2010-09-30T19:10:51Z urn:sha1:8ecec045eaf7d15dea928286da665df5214f4c26 2010-09-25T21:01:39Z Tom Lane 2010-09-25T19:57:05Z urn:sha1:42c387166d4cd3e7151c88692a157bfe9a621a4d It now emerges that the JDBC driver expects to be able to use pg_get_expr() on an output of a sub-SELECT. So extend the check logic to be able to recurse into a sub-SELECT to see if the argument is ultimately coming from an appropriate column. Per report from Thomas Kellerer. 2010-09-24T17:48:47Z Tom Lane 2010-09-24T17:48:47Z urn:sha1:dbf859c711b3d5981a5343a26a35236511b8d0aa Fix overly-enthusiastic ignores, as identified by git ls-files -i --exclude-standard 2010-09-23T20:53:53Z Tom Lane 2010-09-23T20:53:53Z urn:sha1:1e4a7c41102288955b290926b51c556fe8cb7daa hasn't been set. The only known case where this can happen is when show_session_authorization is invoked in an autovacuum process, which is possible if an index function calls it, as for example in bug #5669 from Andrew Geery. We could perhaps try to return a sensible value, such as the name of the cluster-owning superuser; but that seems like much more trouble than the case is worth, and in any case it could create new possible failure modes. Simply returning an empty string seems like the most appropriate fix. Back-patch to all supported versions, even those before autovacuum, just in case there's another way to provoke this crash. 2010-09-23T19:09:10Z Tom Lane 2010-09-23T19:09:10Z urn:sha1:767ae95bedf06b02f824830339ef3dcd8e12898b 2010-09-23T02:33:14Z Tom Lane 2010-09-23T02:33:14Z urn:sha1:54bf75aabe9ec2962fb63229701147b2e167ea3f The previous patches failed to cover a lot of symlinks that are only added in platform-specific cases. Make the lists match what's in the Makefile for each branch. 2010-09-22T21:22:31Z Tom Lane 2010-09-22T21:22:31Z urn:sha1:ec8576114f5cb6a9acc5a6c42f92bf6867015ee0 Also do some further work in the back branches, where quite a bit wasn't covered by Magnus' original back-patch. 2010-09-22T10:57:22Z Magnus Hagander 2010-09-22T10:57:22Z urn:sha1:6b4453fd7128e69e3dc8799e93e31562f4735695