[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <c621d7a710e1a8aa6d989a60a7258c3c92ff06a8.camel@bzed.de>
Date: Thu, 20 Apr 2023 20:39:36 +0200
From: Bernd Zeimetz <bernd@...d.de>
To: oss-security@...ts.openwall.com
Subject: Re: PostgreSQL and CREATEROLE permission
Hi,
> This information showed up on the pgsql-general mailing list at [1].
> It appears a user with CREATEROLE can elevate to root through
> pg_execute_server_program.[2]
really root? As I understand it you gain access to the DB superuser (usually
the postgres user) only. Although I could imagine that you could trick
careless admins into giving you root permissions on that way...
Bernd
--
Bernd Zeimetz Debian GNU/Linux Developer
http://bzed.de http://www.debian.org
GPG Fingerprint: ECA1 E3F2 8E11 2432 D485 DD95 EB36 171A 6FF9 435F
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
