Request a Demo
Home   >   mailing lists

pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O - Mailing list pgsql-committers

From Noah Misch
Subject pgsql: Check for USAGE privilege on the composite type in ALTER TABLE O
Date
Msg-id E1wtQFp-00000000yA8-2ynM@gemulon.postgresql.org
Whole thread
List pgsql-committers
Tree view 
Check for USAGE privilege on the composite type in ALTER TABLE OF.

This omission allowed roles without USAGE on a type to create
tables that depend on it, which could prevent the owner from
changing the type later.

Reported-by: Nathan Bossart <nathandbossart@gmail.com>
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Security: CVE-2026-6470
Backpatch-through: 14

Branch
------
REL_18_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/57f59ca1d954f2de7ac3ef8971046778c955613a
Author: Nathan Bossart <nathan@postgresql.org>

Modified Files
--------------
src/backend/commands/tablecmds.c         | 5 +++++
src/test/regress/expected/privileges.out | 6 ++++++
src/test/regress/sql/privileges.sql      | 5 +++++
3 files changed, 16 insertions(+)

pgsql-committers by date:

Previous
From: Noah Misch
Date:
Subject: pgsql: Use value of scram_iterations in mock_scram_secret().
Next
From: Noah Misch
Date:
Subject: pgsql: Fix out-of-bound reads with ascii() for invalid multibyte charac