Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit67d28bd

Browse files
committed
libpq: Bail out during SSL/GSS negotiation errors
This commit changes libpq so that errors reported by the backend duringthe protocol negotiation for SSL and GSS are discarded by the client, asthese may include bytes that could be consumed by the client and writearbitrary bytes to a client's terminal.A failure with the SSL negotiation now leads to an error immediatelyreported, without a retry on any other methods allowed, like a fallbackto a plaintext connection.A failure with GSS discards the error message received, and we allow afallback as it may be possible that the error is caused by a connectionattempt with a pre-11 server, GSS encryption having been introduced inv12. This was a problem only with v17 and newer versions; olderversions discard the error message already in this case, assuming afailure caused by a lack of support for GSS encryption.Author: Jacob ChampionReviewed-by: Peter Eisentraut, Heikki Linnakangas, Michael PaquierSecurity:CVE-2024-10977Backpatch-through: 12
1 parentf7ca23a commit67d28bd

File tree

2 files changed

+16
-19
lines changed

2 files changed

+16
-19
lines changed

‎doc/src/sgml/protocol.sgml

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1513,10 +1513,10 @@ SELCT 1/0;<!-- this typo is intentional -->
15131513

15141514
<para>
15151515
The frontend should also be prepared to handle an ErrorMessage
1516-
response to SSLRequest from the server. This would only occur if
1517-
theserver predates theaddition of <acronym>SSL</acronym> support
1518-
to <productname>PostgreSQL</productname>. (Such servers are now very ancient,
1519-
and likely do not exist in the wild anymore.)
1516+
response to SSLRequest from the server.The frontend should not display
1517+
this error message totheuser/application, since theserver has not been
1518+
authenticated
1519+
(<ulink url="https://www.postgresql.org/support/security/CVE-2024-10977/">CVE-2024-10977</ulink>).
15201520
In this case the connection must
15211521
be closed, but the frontend might choose to open a fresh connection
15221522
and proceed without requesting <acronym>SSL</acronym>.
@@ -1590,12 +1590,13 @@ SELCT 1/0;<!-- this typo is intentional -->
15901590

15911591
<para>
15921592
The frontend should also be prepared to handle an ErrorMessage
1593-
response to GSSENCRequest from the server. This would only occur if
1594-
the server predates the addition of <acronym>GSSAPI</acronym> encryption
1595-
support to <productname>PostgreSQL</productname>. In this case the
1596-
connection must be closed, but the frontend might choose to open a fresh
1597-
connection and proceed without requesting <acronym>GSSAPI</acronym>
1598-
encryption.
1593+
response to GSSENCRequest from the server. The frontend should not display
1594+
this error message to the user/application, since the server has not been
1595+
authenticated
1596+
(<ulink url="https://www.postgresql.org/support/security/CVE-2024-10977/">CVE-2024-10977</ulink>).
1597+
In this case the connection must be closed, but the frontend might choose
1598+
to open a fresh connection and proceed without requesting
1599+
<acronym>GSSAPI</acronym> encryption.
15991600
</para>
16001601

16011602
<para>

‎src/interfaces/libpq/fe-connect.c

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3388,16 +3388,12 @@ PQconnectPoll(PGconn *conn)
33883388
{
33893389
/*
33903390
* Server failure of some sort, such as failure to
3391-
* fork a backend process. We need to process and
3392-
* report the error message, which might be formatted
3393-
* according to either protocol 2 or protocol 3.
3394-
* Rather than duplicate the code for that, we flip
3395-
* into AWAITING_RESPONSE state and let the code there
3396-
* deal with it. Note we have *not* consumed the "E"
3397-
* byte here.
3391+
* fork a backend process. Don't bother retrieving
3392+
* the error message; we should not trust it as the
3393+
* server has not been authenticated yet.
33983394
*/
3399-
conn->status=CONNECTION_AWAITING_RESPONSE;
3400-
gotokeep_going;
3395+
libpq_append_conn_error(conn,"server sent an error response during SSL exchange");
3396+
gotoerror_return;
34013397
}
34023398
else
34033399
{

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp