Skip to content

Conversation

@ppontes
Copy link
Member

@ppontes ppontes commented Jul 27, 2021

When constructing the synthensized SELECT statement that is used to choose
the rows in an UPDATE FROM, make sure the first table is really the table
being updated, and not some common-table expression that happens to have the
same name. [forum:/forumpost/a274248080|forum post a274248080]. More
changes associated with CTE name resolution are pending.

FossilOrigin-Name: 0f0959c6f95046e8e7887716e0a7de95da18d1e926ab1f919527083a56541db5
(cherry picked from commit 1168f810929ede4d8d323a6acf721ff9cd89de90)
Bug: 1218707
Change-Id: Idfec0bff8422f3ec34b142e5782f7104502d38f8

Notes: Security: backported fix for CVE-2021-30569.

@ppontes ppontes added security 🔒 semver/patch backwards-compatible bug fixes backport-check-skip Skip trop's backport validity checking 13-x-y labels Jul 27, 2021
@ppontes ppontes requested a review from a team as a code owner July 27, 2021 22:12
@zcbenz zcbenz merged commit e57b748 into 13-x-y Jul 30, 2021
@zcbenz zcbenz deleted the cherry-pick/13-x-y/sqlite/1168f81092 branch July 30, 2021 00:00
@release-clerk
Copy link

release-clerk bot commented Jul 30, 2021

Release Notes Persisted

Security: backported fix for CVE-2021-30569.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

13-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants