Thread: Help needed with a reproducer for CVE-2020-25695 not based on REFRESH MATERIALIZED VIEW

Hi,

I need to reproduce the CVE-2020-25695 on PostgreSQL 9.2.24. I know this is not a supported version, however, it is important for us to have a reproducer for this version as well.

The reproducer for supported versions[1] is based on REFRESH MATERIALIZED VIEW which is not implemented until version 9.3.

I was trying to reproduce this using ANALYZE as you can see in this poc.sql file[2]. However, it doesn't reproduce the issue.

It would be really appreciated if someone could take a look at it and help.

We've figured it out. Please ignore.


Regards.

On Fri, Apr 30, 2021 at 3:13 PM Patrik Novotny <panovotn@redhat.com> wrote:
Hi,

I need to reproduce the CVE-2020-25695 on PostgreSQL 9.2.24. I know this is not a supported version, however, it is important for us to have a reproducer for this version as well.

The reproducer for supported versions[1] is based on REFRESH MATERIALIZED VIEW which is not implemented until version 9.3.

I was trying to reproduce this using ANALYZE as you can see in this poc.sql file[2]. However, it doesn't reproduce the issue.

It would be really appreciated if someone could take a look at it and help.



--
Patrik Novotný
Associate Software Engineer
Red Hat
panovotn@redhat.com