Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 20 Apr 2023 20:39:36 +0200
From: Bernd Zeimetz <>
Subject: Re: PostgreSQL and CREATEROLE permission


> This information showed up on the pgsql-general mailing list at [1].
> It appears a user with CREATEROLE can elevate to root through
> pg_execute_server_program.[2]

really root? As I understand it you gain access to the DB superuser (usually
the postgres user) only. Although I could imagine that you could trick
careless admins into giving you root permissions on that way...


 Bernd Zeimetz                            Debian GNU/Linux Developer                      
 GPG Fingerprint: ECA1 E3F2 8E11 2432 D485  DD95 EB36 171A 6FF9 435F

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.