granicus.if.org Git - postgresql/commit

]> granicus.if.org Git - postgresql/commit

author	Tom Lane <tgl@sss.pgh.pa.us>
	Mon, 7 Aug 2017 14:19:01 +0000 (10:19 -0400)
committer	Tom Lane <tgl@sss.pgh.pa.us>
	Mon, 7 Aug 2017 14:19:19 +0000 (10:19 -0400)
commit	8d9881911f0d30e0783a6bb1363b94a2c817433d
tree	90d5c2e6f403433d8c308cd9fd524b499f74ad9c	tree \| snapshot
parent	e568e1eee4650227170cf8c64eedb74bafd7d1f0	commit \| diff

Require update permission for the large object written by lo_put().

lo_put() surely should require UPDATE permission, the same as lowrite(),
but it failed to check for that, as reported by Chapman Flack. Oversight
in commit c50b7c09d; backpatch to 9.4 where that was introduced.

Tom Lane and Michael Paquier

Security: CVE-2017-7548

src/backend/libpq/be-fsstubs.c		diff \| blob \| history
src/test/regress/expected/privileges.out		diff \| blob \| history
src/test/regress/sql/privileges.sql		diff \| blob \| history

Unnamed repository; edit this file 'description' to name the repository.

RSS Atom