pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, createpartitiontime() reads the writable partconfig.timeencoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented partmanuser INSERT and UPDATE privileges can store SQL rather than a function name. When pgpartmanbgw later creates a child partition for a text- or UUID-keyed set, the worker executes the stored SQL with pgpartmanbgw.role privileges, which default to PostgreSQL superuser. The persistent configuration row can repeatedly restore elevated access on later maintenance ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance(), showpartitions(), showpartitioninfo(), undopartition(), and partitiondatatime() interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role with the documented partmanuser privileges can store SQL rather than a decoder function name. When an affected operation later uses the poisoned value, including pgpartmanbgw maintenance for a text- or UUID-keyed set, the SQL executes with the operation's privileges, which can be the default PostgreSQL superuser background-worker role. The persistent row can restore elevated access on later ticks, and successful exploitation can permit database-wide compromise and operating-system command execution as the PostgreSQL service account. This issue is fixed in version 5.5.0.

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid() and droppartitiontime() use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pgpartmanbgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce. This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition() reads partconfig.timeencoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partmanuser access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undopartition(). The function is not part of the default background-worker path, which limits the automatic superuser escalation described by the related create-partition vulnerability, but a privileged caller can still have its available confidentiality, integrity, and availability permissions abused. This issue is fixed in version 5.5.0.

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance() handles exceptions outside the loop that processes rows from partconfig, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partmanuser access can insert or update a row that reliably fails and assign it a low maintenanceorder value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.