Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2a951ef

Browse files
committed
libpq: Bail out during SSL/GSS negotiation errors
This commit changes libpq so that errors reported by the backend duringthe protocol negotiation for SSL and GSS are discarded by the client, asthese may include bytes that could be consumed by the client and writearbitrary bytes to a client's terminal.A failure with the SSL negotiation now leads to an error immediatelyreported, without a retry on any other methods allowed, like a fallbackto a plaintext connection.A failure with GSS discards the error message received, and we allow afallback as it may be possible that the error is caused by a connectionattempt with a pre-11 server, GSS encryption having been introduced inv12. This was a problem only with v17 and newer versions; olderversions discard the error message already in this case, assuming afailure caused by a lack of support for GSS encryption.Author: Jacob ChampionReviewed-by: Peter Eisentraut, Heikki Linnakangas, Michael PaquierSecurity:CVE-2024-10977Backpatch-through: 12
1 parent0ef9ac2 commit2a951ef

File tree

2 files changed

+17
-19
lines changed

2 files changed

+17
-19
lines changed

‎doc/src/sgml/protocol.sgml

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1521,10 +1521,10 @@ SELCT 1/0;<!-- this typo is intentional -->
15211521

15221522
<para>
15231523
The frontend should also be prepared to handle an ErrorMessage
1524-
response to SSLRequest from the server. This would only occur if
1525-
theserver predates theaddition of <acronym>SSL</acronym> support
1526-
to <productname>PostgreSQL</productname>. (Such servers are now very ancient,
1527-
and likely do not exist in the wild anymore.)
1524+
response to SSLRequest from the server.The frontend should not display
1525+
this error message totheuser/application, since theserver has not been
1526+
authenticated
1527+
(<ulink url="https://www.postgresql.org/support/security/CVE-2024-10977/">CVE-2024-10977</ulink>).
15281528
In this case the connection must
15291529
be closed, but the frontend might choose to open a fresh connection
15301530
and proceed without requesting <acronym>SSL</acronym>.
@@ -1597,12 +1597,13 @@ SELCT 1/0;<!-- this typo is intentional -->
15971597

15981598
<para>
15991599
The frontend should also be prepared to handle an ErrorMessage
1600-
response to GSSENCRequest from the server. This would only occur if
1601-
the server predates the addition of <acronym>GSSAPI</acronym> encryption
1602-
support to <productname>PostgreSQL</productname>. In this case the
1603-
connection must be closed, but the frontend might choose to open a fresh
1604-
connection and proceed without requesting <acronym>GSSAPI</acronym>
1605-
encryption.
1600+
response to GSSENCRequest from the server. The frontend should not display
1601+
this error message to the user/application, since the server has not been
1602+
authenticated
1603+
(<ulink url="https://www.postgresql.org/support/security/CVE-2024-10977/">CVE-2024-10977</ulink>).
1604+
In this case the connection must be closed, but the frontend might choose
1605+
to open a fresh connection and proceed without requesting
1606+
<acronym>GSSAPI</acronym> encryption.
16061607
</para>
16071608

16081609
<para>

‎src/interfaces/libpq/fe-connect.c

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2961,16 +2961,13 @@ PQconnectPoll(PGconn *conn)
29612961
{
29622962
/*
29632963
* Server failure of some sort, such as failure to
2964-
* fork a backend process. We need to process and
2965-
* report the error message, which might be formatted
2966-
* according to either protocol 2 or protocol 3.
2967-
* Rather than duplicate the code for that, we flip
2968-
* into AWAITING_RESPONSE state and let the code there
2969-
* deal with it. Note we have *not* consumed the "E"
2970-
* byte here.
2964+
* fork a backend process. Don't bother retrieving
2965+
* the error message; we should not trust it as the
2966+
* server has not been authenticated yet.
29712967
*/
2972-
conn->status=CONNECTION_AWAITING_RESPONSE;
2973-
gotokeep_going;
2968+
appendPQExpBuffer(&conn->errorMessage,
2969+
libpq_gettext("server sent an error response during SSL exchange\n"));
2970+
gotoerror_return;
29742971
}
29752972
else
29762973
{

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp