upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-07-13 20:00:55 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
postgresql/src
History
Nathan Bossart 95cce56696 Check for CREATE privilege on the schema in CREATE STATISTICS. 
This omission allowed table owners to create statistics in any
schema, potentially leading to unexpected naming conflicts.  For
ALTER TABLE commands that require re-creating statistics objects,
skip this check in case the user has since lost CREATE on the
schema.  The addition of a second parameter to CreateStatistics()
breaks ABI compatibility, but we are unaware of any impacted
third-party code.

Reported-by: Jelte Fennema-Nio <postgres@jeltef.nl>
Author: Jelte Fennema-Nio <postgres@jeltef.nl>
Co-authored-by: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de>
Security: CVE-2025-12817
Backpatch-through: 13
2025-11-10 09:00:00 -06:00
..
backend Check for CREATE privilege on the schema in CREATE STATISTICS. 2025-11-10 09:00:00 -06:00
bin Translation updates 2025-11-10 13:06:35 +01:00
common With GB18030, prevent SIGSEGV from reading past end of allocation. 2025-05-05 04:52:08 -07:00
fe_utils In fmtIdEnc(), handle failure of enlargePQExpBuffer(). 2025-02-16 12:46:35 -05:00
include Check for CREATE privilege on the schema in CREATE STATISTICS. 2025-11-10 09:00:00 -06:00
interfaces libpq: Prevent some overflows of int/size_t 2025-11-10 06:03:05 -08:00
makefiles Add NO_INSTALL option to pgxs 2021-05-27 13:58:29 +02:00
pl Translation updates 2025-11-10 13:06:35 +01:00
port Fix POSIX compliance in pgwin32_unsetenv() for "name" argument 2025-10-21 08:08:42 +09:00
template On NetBSD, force dynamic symbol resolution at postmaster start. 2022-08-30 17:29:03 -04:00
test Check for CREATE privilege on the schema in CREATE STATISTICS. 2025-11-10 09:00:00 -06:00
timezone Update time zone data files to tzdata release 2025b. 2025-04-30 11:14:15 -04:00
tools Fix MSVC pg_upgrade test. 2025-08-11 12:37:00 -05:00
tutorial Doc: sync src/tutorial/basics.source with SGML documentation. 2022-11-19 13:09:14 -05:00
.gitignore
DEVELOPERS
Makefile Remove the option to build thread_test.c outside configure. 2020-10-21 12:08:48 -04:00
Makefile.global.in Don't put library-supplied -L/-I switches before user-supplied ones. 2025-07-29 15:17:41 -04:00
Makefile.shlib Stop using "-multiply_defined suppress" on macOS. 2023-09-26 21:06:21 -04:00
nls-global.mk Fix update-po for the PGXS case 2025-10-16 20:21:05 +02:00