PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• gitlab.com/dalibo/postgresql_anonymizer/-/issues/695 Diğer

Kayıt geçmişi

1. 28 Eki 2026 20:31Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-110182PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data
• 4,3 CVE-2026-110183PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking
• 6,5 CVE-2026-105620PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
• 6,5 CVE-2026-110181PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data
• 5,7 CVE-2026-105618PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent
• 4,8 CVE-2026-105619PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views