Description
drop_partition_id() and drop_partition_time() issue ALTER TABLE %I.%I SET SCHEMA %I using part_config.retention_schema as the target. The column has only CHECK (retention_schema '') (rejects empty string only). Any partman_user can write any non-empty schema name there, and the BGW (default pg_partman_bgw.role = postgres, superuser) will execute the relocation — bypassing the standard CREATE privilege check on the target schema that a normal ALTER TABLE … SET SCHEMA would face.
Vulnerability Information
- Product / Framework: PostgreSQL pg_partman
- Vendor Domain: www.postgresql.org
- Vulnerability Type: SQL Injection
- CVE Details: View Full CVE Details →