Request a Demo
Home   >   mailing lists

pgsql: Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE - Mailing list pgsql-committers

From Noah Misch
Subject pgsql: Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE
Date
Msg-id E1wtQFn-00000000y5P-0C1U@gemulon.postgresql.org
Whole thread
Responses pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O
List pgsql-committers
Tree view 
Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE.

This omission allowed roles without USAGE on a type to create range
types that depend on it, which could prevent the owner from
changing the type later.

Reported-by: Jingzhou Fu <fuboat@outlook.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Security: CVE-2026-6470
Backpatch-through: 14

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/efdb260728c93f605f9ef7aaef56b013f6bb87b7
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
doc/src/sgml/ref/create_type.sgml        |  5 +++++
src/backend/commands/typecmds.c          |  4 ++++
src/test/regress/expected/rangetypes.out | 15 +++++++++++++++
src/test/regress/sql/rangetypes.sql      | 14 ++++++++++++++
4 files changed, 38 insertions(+)

pgsql-committers by date:

Previous
From: Noah Misch
Date:
Subject: pgsql: Return nulls honestly in aggregate "combine" functions.
Next
From: Noah Misch
Date:
Subject: pgsql: Use value of scram_iterations in mock_scram_secret().