From f1a336887e1cc754b4985c82827aa70f847980ba Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 10 Feb 2020 12:51:07 -0500 Subject: [PATCH] Last-minute updates for release notes. Security: CVE-2020-1720 --- doc/src/sgml/release-11.sgml | 42 ++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/doc/src/sgml/release-11.sgml b/doc/src/sgml/release-11.sgml index e91a4b922c8..aa78b396c5c 100644 --- a/doc/src/sgml/release-11.sgml +++ b/doc/src/sgml/release-11.sgml @@ -36,6 +36,30 @@ + + Add missing permissions checks for ALTER ... DEPENDS ON + EXTENSION (Álvaro Herrera) + + + + Marking an object as dependent on an extension did not have any + privilege check whatsoever. This oversight allowed any user to mark + routines, triggers, materialized views, or indexes as droppable by + anyone able to drop an extension. Require that the calling user own + the specified object (and hence have privilege to drop it). + (CVE-2020-1720) + + + + + + + Apply more thorough syntax checking + to createuser's + option (Álvaro Herrera) + + + + +