Description
undo_partition()builds a dynamic SQL statement that interpolates thepart_config.time_encoder value raw (%s, not %I) into an EXECUTE format('SELECT %s(%L)', …)call. This is the same vulnerability that was reported in the same audit for the create_partition_time() function, howeverundo_partition()` is not in the BGW path, so the risk of running as a superuser by default is mitigated. However the injection still exists and will execute at caller privilege allowing it to perform any operations that the current caller is allowed.
Vulnerability Information
- Product / Framework: PostgreSQL pg_partman
- Vendor Domain: www.postgresql.org
- Vulnerability Type: SQL Injection
- CVE Details: View Full CVE Details →