Make REPLICATION privilege checks test current user not authenticated user.
The pg_start_backup() and pg_stop_backup() functions checked the privileges of the initially-authenticated user rather than the current user, which is wrong. For example, a user-defined index function could successfully call these functions when executed by ANALYZE within autovacuum. This could allow an attacker with valid but low-privilege database access to interfere with creation of routine backups. Reported and fixed by Noah Misch. Security: CVE-2013-1901 Branch ------ master Details ------- http://git.postgresql.org/pg/commitdiff/ce9ab88981495d975aade8fc664f99f68fc18e2b Modified Files -------------- src/backend/access/transam/xlog.c | 4 ++-- src/backend/utils/init/miscinit.c | 6 +++--- src/backend/utils/init/postinit.c | 2 +- src/include/miscadmin.h | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) -- Sent via pgsql-committers mailing list ([email protected]) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-committers
