Noah Misch aefc625ded In security-restricted operations, block enqueue of at-commit user code. ... Specifically, this blocks DECLARE ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. An attacker having permission to create non-temp objects in at least one schema could execute arbitrary SQL functions under the identity of the bootstrap superuser. One can work around the vulnerability by disabling autovacuum and not manually running ANALYZE, CLUSTER, REINDEX, CREATE INDEX, VACUUM FULL, or REFRESH MATERIALIZED VIEW. (Don't restore from pg_dump, since it runs some of those commands.) Plain VACUUM (without FULL) is safe, and all commands are fine when a trusted user owns the target object. Performance may degrade quickly under this workaround, however. Back-patch to 9.5 (all supported versions). Reviewed by Robert Haas. Reported by Etienne Stalmans. Security: CVE-2020-25695		2020-11-09 07:32:14 -08:00
..
expected	libpq should expose GSS-related parameters even when not implemented.	2019-12-20 15:34:08 -05:00
sql	libpq should expose GSS-related parameters even when not implemented.	2019-12-20 15:34:08 -05:00
.gitignore	Add postgres_fdw contrib module.	2013-02-21 05:27:16 -05:00
connection.c	In security-restricted operations, block enqueue of at-commit user code.	2020-11-09 07:32:14 -08:00
deparse.c	Fix assorted fallout from IS [NOT] NULL patch.	2016-07-28 16:09:15 -04:00
Makefile	Prevent accidental linking of system-supplied copies of libpq.so etc.	2018-07-09 17:23:31 -04:00
option.c	Update copyright for 2015	2015-01-06 11:43:47 -05:00
postgres_fdw--1.0.sql	Add postgres_fdw contrib module.	2013-02-21 05:27:16 -05:00
postgres_fdw.c	postgres_fdw: Account for triggers in non-direct remote UPDATE planning.	2019-06-13 17:59:15 +09:00
postgres_fdw.control	Add postgres_fdw contrib module.	2013-02-21 05:27:16 -05:00
postgres_fdw.h	Allow queries submitted by postgres_fdw to be canceled.	2017-05-06 22:21:38 -04:00