agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Fix SQL injection in logical replication origin checks. 4+ messages / 1 participants [nested] [flat]
* pgsql: Fix SQL injection in logical replication origin checks. @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix SQL injection in logical replication origin checks. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates schema and relation names into SQL without quoting them. A crafted subscriber relation name can inject arbitrary SQL on the publisher. Test such a name. Back-patch to v16, where commit 875693019053b8897ec3983e292acbb439b088c3 first appeared. Reported-by: Pavel Kohout <pavel.kohout@aisle.com> Author: Pavel Kohout <pavel.kohout@aisle.com> Reviewed-by: Nathan Bossart <nathandbossart@gmail.com> Backpatch-through: 16 Security: CVE-2026-6638 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/46b4f5c11b0f2f6e6db834ffafc0d1a01a0373c1 Modified Files -------------- src/backend/commands/subscriptioncmds.c | 18 ++++++++--- src/test/subscription/t/030_origin.pl | 55 +++++++++++++++++---------------- 2 files changed, 43 insertions(+), 30 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix SQL injection in logical replication origin checks. @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix SQL injection in logical replication origin checks. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates schema and relation names into SQL without quoting them. A crafted subscriber relation name can inject arbitrary SQL on the publisher. Test such a name. Back-patch to v16, where commit 875693019053b8897ec3983e292acbb439b088c3 first appeared. Reported-by: Pavel Kohout <pavel.kohout@aisle.com> Author: Pavel Kohout <pavel.kohout@aisle.com> Reviewed-by: Nathan Bossart <nathandbossart@gmail.com> Backpatch-through: 16 Security: CVE-2026-6638 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/cb35d730689546dd7334437f2954a6670fbb967e Modified Files -------------- src/backend/commands/subscriptioncmds.c | 9 ++++-- src/test/subscription/t/030_origin.pl | 55 +++++++++++++++++---------------- 2 files changed, 36 insertions(+), 28 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix SQL injection in logical replication origin checks. @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix SQL injection in logical replication origin checks. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates schema and relation names into SQL without quoting them. A crafted subscriber relation name can inject arbitrary SQL on the publisher. Test such a name. Back-patch to v16, where commit 875693019053b8897ec3983e292acbb439b088c3 first appeared. Reported-by: Pavel Kohout <pavel.kohout@aisle.com> Author: Pavel Kohout <pavel.kohout@aisle.com> Reviewed-by: Nathan Bossart <nathandbossart@gmail.com> Backpatch-through: 16 Security: CVE-2026-6638 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f0f59b658ef10901c9af3af7705c802a72a0577e Modified Files -------------- src/backend/commands/subscriptioncmds.c | 9 +++++++-- src/test/subscription/t/030_origin.pl | 35 ++++++++++++++++++--------------- 2 files changed, 26 insertions(+), 18 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Fix SQL injection in logical replication origin checks. @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix SQL injection in logical replication origin checks. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates schema and relation names into SQL without quoting them. A crafted subscriber relation name can inject arbitrary SQL on the publisher. Test such a name. Back-patch to v16, where commit 875693019053b8897ec3983e292acbb439b088c3 first appeared. Reported-by: Pavel Kohout <pavel.kohout@aisle.com> Author: Pavel Kohout <pavel.kohout@aisle.com> Reviewed-by: Nathan Bossart <nathandbossart@gmail.com> Backpatch-through: 16 Security: CVE-2026-6638 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/248a433cd10759ef968ebed655d19dd1ef129bf6 Modified Files -------------- src/backend/commands/subscriptioncmds.c | 9 +++++++-- src/test/subscription/t/030_origin.pl | 35 ++++++++++++++++++--------------- 2 files changed, 26 insertions(+), 18 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2026-05-11 12:19 UTC | newest] Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-05-11 12:19 pgsql: Fix SQL injection in logical replication origin checks. Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix SQL injection in logical replication origin checks. Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix SQL injection in logical replication origin checks. Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix SQL injection in logical replication origin checks. Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox