Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-36402

Acl_* status values reveal information to unprivileged users

Details

    Description

      Acl_* status values introduced in 10.1 show information about the number of users, roles, grants, etc. across the database, and it is available to any user. Counters are not particularly dangerous as such, but unprivileged users probably shouldn't see them.

      create user foo@localhost;
      show status like 'acl%';
       
      --connect (con1,localhost,foo,,)
      show status like 'acl%';
      --disconnect con1
       
      --connection default
      drop user foo@localhost;
      

      main ab468e33aff110b44a31ce0350894906ff4bc757

      connect  con1,localhost,foo,,;
      show status like 'acl%';
      Variable_name	Value
      Acl_column_grants	0
      Acl_database_grants	0
      Acl_function_grants	0
      Acl_procedure_grants	0
      Acl_package_spec_grants	0
      Acl_package_body_grants	0
      Acl_proxy_users	4
      Acl_role_grants	0
      Acl_roles	0
      Acl_table_grants	1
      Acl_users	6
      disconnect con1;
      

      Attachments

        Activity

          People

            serg Sergei Golubchik
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.