From b89271147deaa0a409a5626d98681bb6f16528e2 Mon Sep 17 00:00:00 2001 From: Kang Kai Date: Wed, 29 Oct 2014 08:30:53 +0800 Subject: postgresql: add fix for CVE-2014-0060 Security Advisory PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0060 Signed-off-by: Yue Tao Signed-off-by: Kai Kang Signed-off-by: Martin Jansa --- meta-oe/recipes-support/postgresql/postgresql.inc | 1 + 1 file changed, 1 insertion(+) (limited to 'meta-oe/recipes-support/postgresql/postgresql.inc') diff --git a/meta-oe/recipes-support/postgresql/postgresql.inc b/meta-oe/recipes-support/postgresql/postgresql.inc index 9b242e0476..d6a4cd781f 100644 --- a/meta-oe/recipes-support/postgresql/postgresql.inc +++ b/meta-oe/recipes-support/postgresql/postgresql.inc @@ -32,6 +32,7 @@ SRC_URI = "http://ftp.postgresql.org/pub/source/v${PV}/${BP}.tar.bz2 \ file://postgresql.service \ file://0001-Use-pkg-config-for-libxml2-detection.patch \ file://0002-Predict-integer-overflow-to-avoid-buffer-overruns.patch \ + file://0003-Shore-up-ADMIN-OPTION-restrictions.patch \ " LEAD_SONAME = "libpq.so" -- cgit v1.2.3-54-g00ecf