Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite92ed93

Browse files
committed
Reject extraneous data after SSL or GSS encryption handshake.
The server collects up to a bufferload of data whenever it reads datafrom the client socket. When SSL or GSS encryption is requestedduring startup, any additional data received with the initialrequest message remained in the buffer, and would be treated asalready-decrypted data once the encryption handshake completed.Thus, a man-in-the-middle with the ability to inject data into theTCP connection could stuff some cleartext data into the start ofa supposedly encryption-protected database session.This could be abused to send faked SQL commands to the server,although that would only work if the server did not demand anyauthentication data. (However, a server relying on SSL certificateauthentication might well not do so.)To fix, throw a protocol-violation error if the internal bufferis not empty after the encryption handshake.Our thanks to Jacob Champion for reporting this problem.Security:CVE-2021-23214
1 parent7c0a78f commite92ed93

File tree

3 files changed

+37
-0
lines changed

3 files changed

+37
-0
lines changed

‎src/backend/libpq/pqcomm.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1183,6 +1183,18 @@ pq_getstring(StringInfo s)
11831183
}
11841184
}
11851185

1186+
/* --------------------------------
1187+
*pq_buffer_has_data- is any buffered data available to read?
1188+
*
1189+
* This will *not* attempt to read more data.
1190+
* --------------------------------
1191+
*/
1192+
bool
1193+
pq_buffer_has_data(void)
1194+
{
1195+
return (PqRecvPointer<PqRecvLength);
1196+
}
1197+
11861198

11871199
/* --------------------------------
11881200
*pq_startmsgread - begin reading a message from the client.

‎src/backend/postmaster/postmaster.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2049,6 +2049,18 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20492049
returnSTATUS_ERROR;
20502050
#endif
20512051

2052+
/*
2053+
* At this point we should have no data already buffered. If we do,
2054+
* it was received before we performed the SSL handshake, so it wasn't
2055+
* encrypted and indeed may have been injected by a man-in-the-middle.
2056+
* We report this case to the client.
2057+
*/
2058+
if (pq_buffer_has_data())
2059+
ereport(FATAL,
2060+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2061+
errmsg("received unencrypted data after SSL request"),
2062+
errdetail("This could be either a client-software bug or evidence of an attempted man-in-the-middle attack.")));
2063+
20522064
/*
20532065
* regular startup packet, cancel, etc packet should follow, but not
20542066
* another SSL negotiation request, and a GSS request should only
@@ -2081,6 +2093,18 @@ ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done)
20812093
returnSTATUS_ERROR;
20822094
#endif
20832095

2096+
/*
2097+
* At this point we should have no data already buffered. If we do,
2098+
* it was received before we performed the GSS handshake, so it wasn't
2099+
* encrypted and indeed may have been injected by a man-in-the-middle.
2100+
* We report this case to the client.
2101+
*/
2102+
if (pq_buffer_has_data())
2103+
ereport(FATAL,
2104+
(errcode(ERRCODE_PROTOCOL_VIOLATION),
2105+
errmsg("received unencrypted data after GSSAPI encryption request"),
2106+
errdetail("This could be either a client-software bug or evidence of an attempted man-in-the-middle attack.")));
2107+
20842108
/*
20852109
* regular startup packet, cancel, etc packet should follow, but not
20862110
* another GSS negotiation request, and an SSL request should only

‎src/include/libpq/libpq.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ extern intpq_getmessage(StringInfo s, int maxlen);
7272
externintpq_getbyte(void);
7373
externintpq_peekbyte(void);
7474
externintpq_getbyte_if_available(unsignedchar*c);
75+
externboolpq_buffer_has_data(void);
7576
externintpq_putbytes(constchar*s,size_tlen);
7677

7778
/*

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp