diff options
| author | Noah Misch <noah@leadboat.com> | 2020-08-10 09:22:54 -0700 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2020-08-10 09:22:59 -0700 |
| commit | dd5d9951618831aa8f015c6a0ebd3a8f96a9ac32 (patch) | |
| tree | 72cd025f17a8a532a89abca0522886ea691020ca /src/backend/executor/nodeGroup.c | |
| parent | 670050d68f32b4945528ace8dcef9eb4aabcbd8a (diff) | |
Empty search_path in logical replication apply worker and walsender.
This is like CVE-2018-1058 commit
582edc369cdbd348d68441fc50fa26a84afd0c1a. Today, a malicious user of a
publisher or subscriber database can invoke arbitrary SQL functions
under an identity running replication, often a superuser. This fix may
cause "does not exist" or "no schema has been selected to create in"
errors in a replication process. After upgrading, consider watching
server logs for these errors. Objects accruing schema qualification in
the wake of the earlier commit are unlikely to need further correction.
Back-patch to v10, which introduced logical replication.
Security: CVE-2020-14349
Diffstat (limited to 'src/backend/executor/nodeGroup.c')
0 files changed, 0 insertions, 0 deletions