From: Michael Paquier <michael@paquier.xyz>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: libpq: Bail out during SSL/GSS negotiation errors
Date: Mon, 11 Nov 2024 01:20:44 +0000
Message-ID: <E1tAJ6h-001ELJ-SJ@gemulon.postgresql.org> (raw)
libpq: Bail out during SSL/GSS negotiation errors
This commit changes libpq so that errors reported by the backend during
the protocol negotiation for SSL and GSS are discarded by the client, as
these may include bytes that could be consumed by the client and write
arbitrary bytes to a client's terminal.
A failure with the SSL negotiation now leads to an error immediately
reported, without a retry on any other methods allowed, like a fallback
to a plaintext connection.
A failure with GSS discards the error message received, and we allow a
fallback as it may be possible that the error is caused by a connection
attempt with a pre-11 server, GSS encryption having been introduced in
v12. This was a problem only with v17 and newer versions; older
versions discard the error message already in this case, assuming a
failure caused by a lack of support for GSS encryption.
Author: Jacob Champion
Reviewed-by: Peter Eisentraut, Heikki Linnakangas, Michael Paquier
Security: CVE-2024-10977
Backpatch-through: 12
Branch
------
REL_12_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/2a951ef0aace58026c31b9a88aeeda19c9af4205
Modified Files
--------------
doc/src/sgml/protocol.sgml | 21 +++++++++++----------
src/interfaces/libpq/fe-connect.c | 15 ++++++---------
2 files changed, 17 insertions(+), 19 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: libpq: Bail out during SSL/GSS negotiation errors
In-Reply-To: <E1tAJ6h-001ELJ-SJ@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox