granicus.if.org Git - postgresql/commit

]> granicus.if.org Git - postgresql/commit

author	Tom Lane <tgl@sss.pgh.pa.us>
	Mon, 7 Aug 2017 14:19:01 +0000 (10:19 -0400)
committer	Tom Lane <tgl@sss.pgh.pa.us>
	Mon, 7 Aug 2017 14:19:22 +0000 (10:19 -0400)
commit	f1cda6d6cbb2b551331802cab57957fa5307cf2c
tree	7da145bc52d84c8413028bb7a5a2f56b7476359e	tree \| snapshot
parent	b6e39ca92eeee4e5fa0e83ce3e04dad82559983f	commit \| diff

Require update permission for the large object written by lo_put().

lo_put() surely should require UPDATE permission, the same as lowrite(),
but it failed to check for that, as reported by Chapman Flack. Oversight
in commit c50b7c09d; backpatch to 9.4 where that was introduced.

Tom Lane and Michael Paquier

Security: CVE-2017-7548

src/backend/libpq/be-fsstubs.c		diff \| blob \| history
src/test/regress/expected/privileges.out		diff \| blob \| history
src/test/regress/sql/privileges.sql		diff \| blob \| history

Unnamed repository; edit this file 'description' to name the repository.

RSS Atom