upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-03-05 14:54:02 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
Base de données relationnelle
29938 commits 38 branches 679 tags 863 MiB
C 84.7%
PLpgSQL 6.1%
Perl 4.8%
Yacc 1.2%
Meson 0.7%
Other 2.4%
Find a file
Tom Lane 9ead05b7c3 Prevent PL/Tcl from loading the "unknown" module from pltcl_modules unless 
that is a regular table or view owned by a superuser.  This prevents a
trojan horse attack whereby any unprivileged SQL user could create such a
table and insert code into it that would then get executed in other users'
sessions whenever they call pltcl functions.

Worse yet, because the code was automatically loaded into both the "normal"
and "safe" interpreters at first use, the attacker could execute unrestricted
Tcl code in the "normal" interpreter without there being any pltclu functions
anywhere, or indeed anyone else using pltcl at all: installing pltcl is
sufficient to open the hole.  Change the initialization logic so that the
"unknown" code is only loaded into an interpreter when the interpreter is
first really used.  (That doesn't add any additional security in this
particular context, but it seems a prudent change, and anyway the former
behavior violated the principle of least astonishment.)

Security: CVE-2010-1170
2010-05-13 18:29:12 +00:00
config Update config.guess and config.sub 2010-05-12 16:50:57 +00:00
contrib Assorted fixes to make pg_upgrade build on MSVC. 2010-05-13 15:58:15 +00:00
doc Prevent PL/Tcl from loading the "unknown" module from pltcl_modules unless 2010-05-13 18:29:12 +00:00
src Prevent PL/Tcl from loading the "unknown" module from pltcl_modules unless 2010-05-13 18:29:12 +00:00
aclocal.m4 Add new auto-detection of thread flags. 2004-04-23 18:15:55 +00:00
configure tag for 9.0beta1 2010-04-30 03:16:58 +00:00
configure.in tag for 9.0beta1 2010-04-30 03:16:58 +00:00
COPYRIGHT Update copyright for the year 2010. 2010-01-02 16:58:17 +00:00
GNUmakefile.in Separate targets "make docs" and "make install-docs" for the documentation 2010-03-30 00:10:46 +00:00
Makefile Add new make targets "world", "install-world" and "installcheck-world" to build, install and check just about everything. 2010-01-28 23:59:52 +00:00
README Point to our download URL, rather than listing interface in the README 2008-05-06 22:02:12 +00:00
README.CVS Fix the makefiles to fail cleanly if Perl is needed but not present. This 2009-06-23 03:46:00 +00:00

README 

PostgreSQL Database Management System
=====================================
  
This directory contains the source code distribution of the PostgreSQL
database management system.

PostgreSQL is an advanced object-relational database management system
that supports an extended subset of the SQL standard, including
transactions, foreign keys, subqueries, triggers, user-defined types
and functions.  This distribution also contains C language bindings.

PostgreSQL has many language interfaces, many of which are listed here:

	http://www.postgresql.org/download

See the file INSTALL for instructions on how to build and install
PostgreSQL.  That file also lists supported operating systems and
hardware platforms and contains information regarding any other
software packages that are required to build or run the PostgreSQL
system.  Changes between all PostgreSQL releases are recorded in the
file HISTORY.  Copyright and license information can be found in the
file COPYRIGHT.  A comprehensive documentation set is included in this
distribution; it can be read as described in the installation
instructions.

The latest version of this software may be obtained at
http://www.postgresql.org/download/.  For more information look at our
web site located at http://www.postgresql.org/.