forked frompostgres/postgres
- Notifications
You must be signed in to change notification settings - Fork6
Commit3855e5b
committed
Ignore attempts to \gset into specially treated variables.
If an interactive psql session used \gset when querying a compromisedserver, the attacker could execute arbitrary code as the operatingsystem account running psql. Using a prefix not found among speciallytreated variables, e.g. every lowercase string, precluded the attack.Fix by issuing a warning and setting no variable for the column inquestion. Users wanting the old behavior can use a prefix and then ameta-command like "\set HISTSIZE :prefix_HISTSIZE". Back-patch to 9.5(all supported versions).Reviewed by Robert Haas. Reported by Nick Cleaton.Security:CVE-2020-256961 parentac8f624 commit3855e5b
File tree
5 files changed
+41
-0
lines changed- src
- bin/psql
- test/regress
- expected
- sql
5 files changed
+41
-0
lines changedLines changed: 7 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
921 | 921 |
| |
922 | 922 |
| |
923 | 923 |
| |
| 924 | + | |
| 925 | + | |
| 926 | + | |
| 927 | + | |
| 928 | + | |
| 929 | + | |
| 930 | + | |
924 | 931 |
| |
925 | 932 |
| |
926 | 933 |
| |
|
Lines changed: 26 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
362 | 362 |
| |
363 | 363 |
| |
364 | 364 |
| |
| 365 | + | |
| 366 | + | |
| 367 | + | |
| 368 | + | |
| 369 | + | |
| 370 | + | |
| 371 | + | |
| 372 | + | |
| 373 | + | |
| 374 | + | |
| 375 | + | |
| 376 | + | |
| 377 | + | |
| 378 | + | |
| 379 | + | |
| 380 | + | |
| 381 | + | |
| 382 | + | |
| 383 | + | |
| 384 | + | |
| 385 | + | |
| 386 | + | |
| 387 | + | |
| 388 | + | |
| 389 | + | |
| 390 | + | |
365 | 391 |
| |
366 | 392 |
| |
367 | 393 |
| |
|
Lines changed: 1 addition & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
90 | 90 |
| |
91 | 91 |
| |
92 | 92 |
| |
| 93 | + | |
93 | 94 |
| |
94 | 95 |
| |
95 | 96 |
| |
|
Lines changed: 4 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
84 | 84 |
| |
85 | 85 |
| |
86 | 86 |
| |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
87 | 91 |
| |
88 | 92 |
| |
89 | 93 |
| |
|
Lines changed: 3 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
48 | 48 |
| |
49 | 49 |
| |
50 | 50 |
| |
| 51 | + | |
| 52 | + | |
| 53 | + | |
51 | 54 |
| |
52 | 55 |
| |
53 | 56 |
| |
|
0 commit comments
Comments
(0)