pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Restrict psql meta-commands in plain-text dumps. 7+ messages / 1 participants [nested] [flat]
* pgsql: Restrict psql meta-commands in plain-text dumps. @ 2025-08-11 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2025-08-11 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/67a2fbb8f9e9f75df08208e75da412c43a814688 Modified Files -------------- doc/src/sgml/ref/pg_dump.sgml | 35 +++++++++ doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++ doc/src/sgml/ref/pg_restore.sgml | 34 ++++++++ doc/src/sgml/ref/pgupgrade.sgml | 8 ++ doc/src/sgml/ref/psql-ref.sgml | 36 +++++++++ src/bin/pg_combinebackup/t/002_compare_backups.pl | 2 + src/bin/pg_dump/dumputils.c | 38 +++++++++ src/bin/pg_dump/dumputils.h | 3 + src/bin/pg_dump/pg_backup.h | 4 + src/bin/pg_dump/pg_backup_archiver.c | 32 +++++++- src/bin/pg_dump/pg_dump.c | 21 +++++ src/bin/pg_dump/pg_dumpall.c | 36 +++++++++ src/bin/pg_dump/pg_restore.c | 23 ++++++ src/bin/pg_dump/t/002_pg_dump.pl | 26 +++++-- src/bin/pg_upgrade/t/002_pg_upgrade.pl | 3 + src/bin/psql/command.c | 94 ++++++++++++++++++++++- src/bin/psql/help.c | 4 + src/bin/psql/t/001_basic.pl | 7 ++ src/bin/psql/tab-complete.in.c | 4 +- src/test/recovery/t/027_stream_regress.pl | 4 + src/test/regress/expected/psql.out | 2 + src/test/regress/sql/psql.sql | 2 + 22 files changed, 435 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Restrict psql meta-commands in plain-text dumps. @ 2025-08-11 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2025-08-11 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/e4998d089d903da6114209ae36da747b195375ca Modified Files -------------- doc/src/sgml/ref/pg_dump.sgml | 35 ++++++++++++++ doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++++++ doc/src/sgml/ref/pg_restore.sgml | 34 +++++++++++++ doc/src/sgml/ref/pgupgrade.sgml | 8 +++ doc/src/sgml/ref/psql-ref.sgml | 36 ++++++++++++++ src/bin/pg_dump/dumputils.c | 38 +++++++++++++++ src/bin/pg_dump/dumputils.h | 3 ++ src/bin/pg_dump/pg_backup.h | 4 ++ src/bin/pg_dump/pg_backup_archiver.c | 32 +++++++++++- src/bin/pg_dump/pg_dump.c | 21 ++++++++ src/bin/pg_dump/pg_dumpall.c | 42 ++++++++++++++++ src/bin/pg_dump/pg_restore.c | 31 ++++++++++++ src/bin/pg_dump/t/002_pg_dump.pl | 19 ++++++-- src/bin/pg_upgrade/test.sh | 2 + src/bin/psql/command.c | 94 +++++++++++++++++++++++++++++++++++- src/bin/psql/help.c | 4 ++ src/bin/psql/tab-complete.c | 4 +- src/test/regress/expected/psql.out | 2 + src/test/regress/sql/psql.sql | 2 + 19 files changed, 431 insertions(+), 10 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Restrict psql meta-commands in plain-text dumps. @ 2025-08-11 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2025-08-11 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/7ad8e790988d3a49010ec00e0cec0dace4c7416f Modified Files -------------- doc/src/sgml/ref/pg_dump.sgml | 35 ++++++++++++ doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++++ doc/src/sgml/ref/pg_restore.sgml | 34 +++++++++++ doc/src/sgml/ref/pgupgrade.sgml | 8 +++ doc/src/sgml/ref/psql-ref.sgml | 36 ++++++++++++ src/bin/pg_dump/dumputils.c | 38 +++++++++++++ src/bin/pg_dump/dumputils.h | 3 + src/bin/pg_dump/pg_backup.h | 4 ++ src/bin/pg_dump/pg_backup_archiver.c | 32 ++++++++++- src/bin/pg_dump/pg_dump.c | 21 +++++++ src/bin/pg_dump/pg_dumpall.c | 36 ++++++++++++ src/bin/pg_dump/pg_restore.c | 22 ++++++++ src/bin/pg_dump/t/002_pg_dump.pl | 19 +++++-- src/bin/pg_upgrade/t/002_pg_upgrade.pl | 2 + src/bin/psql/command.c | 94 ++++++++++++++++++++++++++++++- src/bin/psql/help.c | 4 ++ src/bin/psql/t/001_basic.pl | 7 +++ src/bin/psql/tab-complete.c | 4 +- src/test/recovery/t/027_stream_regress.pl | 4 ++ src/test/regress/expected/psql.out | 2 + src/test/regress/sql/psql.sql | 2 + 21 files changed, 427 insertions(+), 10 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Restrict psql meta-commands in plain-text dumps. @ 2025-08-11 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2025-08-11 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 Branch ------ REL_13_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/c204bd39f7b57284363390f50e81abfc350a0fb9 Modified Files -------------- doc/src/sgml/ref/pg_dump.sgml | 35 ++++++++++++++ doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++++++ doc/src/sgml/ref/pg_restore.sgml | 34 +++++++++++++ doc/src/sgml/ref/pgupgrade.sgml | 8 +++ doc/src/sgml/ref/psql-ref.sgml | 36 ++++++++++++++ src/bin/pg_dump/dumputils.c | 38 +++++++++++++++ src/bin/pg_dump/dumputils.h | 3 ++ src/bin/pg_dump/pg_backup.h | 4 ++ src/bin/pg_dump/pg_backup_archiver.c | 32 +++++++++++- src/bin/pg_dump/pg_dump.c | 21 ++++++++ src/bin/pg_dump/pg_dumpall.c | 42 ++++++++++++++++ src/bin/pg_dump/pg_restore.c | 31 ++++++++++++ src/bin/pg_dump/t/002_pg_dump.pl | 19 ++++++-- src/bin/pg_upgrade/test.sh | 2 + src/bin/psql/command.c | 94 +++++++++++++++++++++++++++++++++++- src/bin/psql/help.c | 4 ++ src/bin/psql/tab-complete.c | 4 +- src/test/regress/expected/psql.out | 2 + src/test/regress/sql/psql.sql | 2 + 19 files changed, 431 insertions(+), 10 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Restrict psql meta-commands in plain-text dumps. @ 2025-08-11 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2025-08-11 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/71ea0d6795438f95f4ee6e35867058c44b270d51 Modified Files -------------- doc/src/sgml/ref/pg_dump.sgml | 35 +++++++++ doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++ doc/src/sgml/ref/pg_restore.sgml | 34 ++++++++ doc/src/sgml/ref/pgupgrade.sgml | 8 ++ doc/src/sgml/ref/psql-ref.sgml | 36 +++++++++ src/bin/pg_combinebackup/t/002_compare_backups.pl | 2 + src/bin/pg_dump/dumputils.c | 38 +++++++++ src/bin/pg_dump/dumputils.h | 3 + src/bin/pg_dump/pg_backup.h | 4 + src/bin/pg_dump/pg_backup_archiver.c | 32 +++++++- src/bin/pg_dump/pg_dump.c | 21 +++++ src/bin/pg_dump/pg_dumpall.c | 36 +++++++++ src/bin/pg_dump/pg_restore.c | 23 ++++++ src/bin/pg_dump/t/002_pg_dump.pl | 26 +++++-- src/bin/pg_upgrade/t/002_pg_upgrade.pl | 3 + src/bin/psql/command.c | 94 ++++++++++++++++++++++- src/bin/psql/help.c | 4 + src/bin/psql/t/001_basic.pl | 7 ++ src/bin/psql/tab-complete.in.c | 4 +- src/test/recovery/t/027_stream_regress.pl | 4 + src/test/regress/expected/psql.out | 2 + src/test/regress/sql/psql.sql | 2 + 22 files changed, 435 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Restrict psql meta-commands in plain-text dumps. @ 2025-08-11 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2025-08-11 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/42404050685de4047a7b57b13f8ec4959666328a Modified Files -------------- doc/src/sgml/ref/pg_dump.sgml | 35 ++++++++++++ doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++++ doc/src/sgml/ref/pg_restore.sgml | 34 +++++++++++ doc/src/sgml/ref/pgupgrade.sgml | 8 +++ doc/src/sgml/ref/psql-ref.sgml | 36 ++++++++++++ src/bin/pg_dump/dumputils.c | 38 +++++++++++++ src/bin/pg_dump/dumputils.h | 3 + src/bin/pg_dump/pg_backup.h | 4 ++ src/bin/pg_dump/pg_backup_archiver.c | 32 ++++++++++- src/bin/pg_dump/pg_dump.c | 21 +++++++ src/bin/pg_dump/pg_dumpall.c | 36 ++++++++++++ src/bin/pg_dump/pg_restore.c | 22 ++++++++ src/bin/pg_dump/t/002_pg_dump.pl | 19 +++++-- src/bin/pg_upgrade/t/002_pg_upgrade.pl | 2 + src/bin/psql/command.c | 94 ++++++++++++++++++++++++++++++- src/bin/psql/help.c | 4 ++ src/bin/psql/t/001_basic.pl | 7 +++ src/bin/psql/tab-complete.c | 4 +- src/test/recovery/t/027_stream_regress.pl | 4 ++ src/test/regress/expected/psql.out | 2 + src/test/regress/sql/psql.sql | 2 + 21 files changed, 427 insertions(+), 10 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
* pgsql: Restrict psql meta-commands in plain-text dumps. @ 2025-08-11 14:00 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 7+ messages in thread From: Nathan Bossart @ 2025-08-11 14:00 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/575f54d4cee8b141a91b3e5c3d7d65372c0f5219 Modified Files -------------- doc/src/sgml/ref/pg_dump.sgml | 35 +++++++++ doc/src/sgml/ref/pg_dumpall.sgml | 30 ++++++++ doc/src/sgml/ref/pg_restore.sgml | 34 ++++++++ doc/src/sgml/ref/pgupgrade.sgml | 8 ++ doc/src/sgml/ref/psql-ref.sgml | 36 +++++++++ src/bin/pg_combinebackup/t/002_compare_backups.pl | 2 + src/bin/pg_dump/dumputils.c | 38 +++++++++ src/bin/pg_dump/dumputils.h | 3 + src/bin/pg_dump/pg_backup.h | 4 + src/bin/pg_dump/pg_backup_archiver.c | 32 +++++++- src/bin/pg_dump/pg_dump.c | 21 +++++ src/bin/pg_dump/pg_dumpall.c | 36 +++++++++ src/bin/pg_dump/pg_restore.c | 22 ++++++ src/bin/pg_dump/t/002_pg_dump.pl | 26 +++++-- src/bin/pg_upgrade/t/002_pg_upgrade.pl | 2 + src/bin/psql/command.c | 94 ++++++++++++++++++++++- src/bin/psql/help.c | 4 + src/bin/psql/t/001_basic.pl | 7 ++ src/bin/psql/tab-complete.c | 4 +- src/test/recovery/t/027_stream_regress.pl | 4 + src/test/regress/expected/psql.out | 2 + src/test/regress/sql/psql.sql | 2 + 22 files changed, 433 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2025-08-11 14:00 UTC | newest] Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-08-11 14:00 pgsql: Restrict psql meta-commands in plain-text dumps. Nathan Bossart <nathan@postgresql.org> 2025-08-11 14:00 pgsql: Restrict psql meta-commands in plain-text dumps. Nathan Bossart <nathan@postgresql.org> 2025-08-11 14:00 pgsql: Restrict psql meta-commands in plain-text dumps. Nathan Bossart <nathan@postgresql.org> 2025-08-11 14:00 pgsql: Restrict psql meta-commands in plain-text dumps. Nathan Bossart <nathan@postgresql.org> 2025-08-11 14:00 pgsql: Restrict psql meta-commands in plain-text dumps. Nathan Bossart <nathan@postgresql.org> 2025-08-11 14:00 pgsql: Restrict psql meta-commands in plain-text dumps. Nathan Bossart <nathan@postgresql.org> 2025-08-11 14:00 pgsql: Restrict psql meta-commands in plain-text dumps. Nathan Bossart <nathan@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox