PostgreSQL security fix timeline
Public commits from postgres/postgres whose messages cite a vulnerability or a security fix. Patch text is not stored.
58 security-fix timeline events
May 6, 2024 · CVE-2024-4317
Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs.
Fix privilege checks in pg_stats_ext and pg_stats_ext_exprs. The catalog view pg_stats_ext fails to consider privileges for expression statistics. The catalog view pg_stats_ext_exprs fails to consider privileges and row-level security policies. To fix, restrict the data in thes…
Aug 7, 2023 · CVE-2023-39417
Reject substituting extension schemas or owners matching ["$'\].
Reject substituting extension schemas or owners matching ["$'\]. Substituting such values in extension scripts facilitated SQL injection when @extowner@, @extschema@, or @extschema:...@ appeared inside a quoting construct (dollar quoting, '', or ""). No bundled extension was vu…
Aug 1, 2023
Remove PushOverrideSearchPath() and PopOverrideSearchPath().
Remove PushOverrideSearchPath() and PopOverrideSearchPath(). Since commit 681d9e4621aac0a9c71364b6f54f00f6d8c4337f, they have no in-tree calls. Any new calls would introduce security vulnerabilities like the one fixed in that commit. Alexander Lakhin, reviewed by Aleksander Al…
May 8, 2023 · CVE-2023-2454
Replace last PushOverrideSearchPath() call with set_config_option().
Replace last PushOverrideSearchPath() call with set_config_option(). The two methods don't cooperate, so set_config_option("search_path", ...) has been ineffective under non-empty overrideStack. This defect enabled an attacker having database-level CREATE privilege to execute a…
Mar 25, 2023
Comment on expectations for AutoVacuumWorkItem handlers.
Comment on expectations for AutoVacuumWorkItem handlers. This might prevent a repeat of the brin_summarize_range() vulnerability that commit a117cebd638dd02e5c2e791c25e43745f233111b fixed.
Feb 6, 2023 · CVE-2022-41862
Properly NULL-terminate GSS receive buffer on error packet reception
Properly NULL-terminate GSS receive buffer on error packet reception pqsecure_open_gss() includes a code path handling error messages with v2-style protocol messages coming from the server. The client-side buffer holding the error message does not force a NULL-termination, with…
Jan 21, 2023
Reject CancelRequestPacket having unexpected length.
Reject CancelRequestPacket having unexpected length. When the length was too short, the server read outside the allocation. That yielded the same log noise as sending the correct length with (backendPID,cancelAuthCode) matching nothing. Change to a message about the unexpected…
Sep 19, 2022
Make ALTER DEFAULT PRIVILEGES require privileges, not membership.
Make ALTER DEFAULT PRIVILEGES require privileges, not membership. If role A is a direct or indirect member of role B but does not inherit B's privileges (because at least one relevant grant was created WITH INHERIT FALSE) then A should not be permitted to bypass privilege check…