database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

Lock down regression testing temporary clusters on Windows.

Browse Source 
Use SSPI authentication to allow connections exclusively from the OS
user that launched the test suite.  This closes on Windows the
vulnerability that commit be76a6d39e
closed on other platforms.  Users of "make installcheck" or custom test
harnesses can run "pg_regress --config-auth=DATADIR" to activate the
same authentication configuration that "make check" would use.
Back-patch to 9.0 (all supported versions).

Security: CVE-2014-0067
This commit is contained in:
Noah Misch
2014-12-17 22:48:40 -05:00
parent 3f63b38fb2
commit 6b87d423dc
11 changed files with 213 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
doc/src/sgml/regress.sgml
View File

@ -56,19 +56,6 @@ make check
<quote>failure</> represents a serious problem.
</para>
<warning>
<para>
On systems lacking Unix-domain sockets, notably Windows, this test method
starts a temporary server configured to accept any connection originating
on the local machine. Any local user can gain database superuser
privileges when connecting to this server, and could in principle exploit
all privileges of the operating-system user running the tests. Therefore,
it is not recommended that you use <literal>make check</> on an affected
system shared with untrusted users. Instead, run the tests after
completing the installation, as described in the next section.
</para>
</warning>
<para>
Because this test method runs a temporary server, it will not work
if you did the build as the root user, since the server will not start as