Side effect of CVE-2017-7484 fix?
От
Dilip Kumar
Тема
Side effect of CVE-2017-7484 fix?
Дата
Msg-id
CAFiTN-tWSO0riLe3_cfsrLjfoUU6iFN8+rP2Y06BEgLH9HP5+w@mail.gmail.com
Список
Дерево обсуждения
Side effect of CVE-2017-7484 fix? Dilip Kumar <dilipbalaut@gmail.com>
Re: Side effect of CVE-2017-7484 fix? Stephen Frost <sfrost@snowman.net>
Re: Side effect of CVE-2017-7484 fix? Amit Langote <Langote_Amit_f8@lab.ntt.co.jp>
Re: Side effect of CVE-2017-7484 fix? Dilip Kumar <dilipbalaut@gmail.com>
Re: Side effect of CVE-2017-7484 fix? David Fetter <david@fetter.org>
Re: Side effect of CVE-2017-7484 fix? Dilip Kumar <dilipbalaut@gmail.com>
Re: Side effect of CVE-2017-7484 fix? David Fetter <david@fetter.org>
Re: Side effect of CVE-2017-7484 fix? Dilip Kumar <dilipbalaut@gmail.com>
Re: Side effect of CVE-2017-7484 fix? Tom Lane <tgl@sss.pgh.pa.us>
Re: Side effect of CVE-2017-7484 fix? Robert Haas <robertmhaas@gmail.com>
Re: Side effect of CVE-2017-7484 fix? Tom Lane <tgl@sss.pgh.pa.us>
Re: Side effect of CVE-2017-7484 fix? Bruce Momjian <bruce@momjian.us>
Re: Side effect of CVE-2017-7484 fix? Tom Lane <tgl@sss.pgh.pa.us>
Re: Side effect of CVE-2017-7484 fix? Bruce Momjian <bruce@momjian.us>
Re: Side effect of CVE-2017-7484 fix? Dilip Kumar <dilipbalaut@gmail.com>
As part of the security fix (e2d4ef8de869c57e3bf270a30c12d48c2ce4e00c), we have restricted the users from accessing the statistics of the table if the user doesn't have privileges on the table and the function is not leakproof. Now, as a side effect of this, if the user has the privileges on the root partitioned table but does not have privilege on the child tables, the user will be able to access the data of the child table but it won't be able to access the statistics of the child table. This may result in a bad plan. I am not sure what should be the fix. Should we allow to access the statistics of the table if a user has privilege on its parent table? -- Regards, Dilip Kumar EnterpriseDB: http://www.enterprisedb.com
В списке pgsql-hackers по дате отправления