mirror of
https://github.com/timescale/timescaledb.git
synced 2025-05-15 18:13:18 +08:00
c8b8516e46
TimescaleDB was vulnerable to a privilege escalation attack in the extension installation script. An attacker could precreate objects normally owned by the extension and get those objects used in the installation script since the script would only try to create them if they did not already exist. Thanks to Pedro Gallegos for reporting the problem. This patch changes the schema, table and function creation to fail and abort the installation when the object already exists instead of using the existing object. Security: CVE-2022-24128
28 lines
1.4 KiB
SQL
28 lines
1.4 KiB
SQL
-- This file and its contents are licensed under the Apache License 2.0.
|
|
-- Please see the included NOTICE for copyright information and
|
|
-- LICENSE-APACHE for a copy of the license.
|
|
|
|
-- This file contains infrastructure for cache invalidation of TimescaleDB
|
|
-- metadata caches kept in C. Please look at cache_invalidate.c for a
|
|
-- description of how this works.
|
|
CREATE TABLE _timescaledb_cache.cache_inval_hypertable();
|
|
|
|
-- For notifying the scheduler of changes to the bgw_job table.
|
|
CREATE TABLE _timescaledb_cache.cache_inval_bgw_job();
|
|
|
|
-- This is pretty subtle. We create this dummy cache_inval_extension table
|
|
-- solely for the purpose of getting a relcache invalidation event when it is
|
|
-- deleted on DROP extension. It has no related triggers. When the table is
|
|
-- invalidated, all backends will be notified and will know that they must
|
|
-- invalidate all cached information, including catalog table and index OIDs,
|
|
-- etc.
|
|
CREATE TABLE _timescaledb_cache.cache_inval_extension();
|
|
|
|
-- not actually strictly needed but good for sanity as all tables should be dumped.
|
|
SELECT pg_catalog.pg_extension_config_dump('_timescaledb_cache.cache_inval_hypertable', '');
|
|
SELECT pg_catalog.pg_extension_config_dump('_timescaledb_cache.cache_inval_extension', '');
|
|
SELECT pg_catalog.pg_extension_config_dump('_timescaledb_cache.cache_inval_bgw_job', '');
|
|
|
|
GRANT SELECT ON ALL TABLES IN SCHEMA _timescaledb_cache TO PUBLIC;
|
|
|