agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam 3+ messages / 1 participants [nested] [flat]
* pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 3+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_createsubscriber: Obstruct SQL injection via subscription names. drop_existing_subscription() neglected to escape the subscription name when generating its query string. To fix, use PQescapeIdentifier() to construct a properly escaped name, and use it in the ALTER SUBSCRIPTION and DROP SUBSCRIPTION commands. Reported-by: Yu Kunpeng <yu443940816@live.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Security: CVE-2026-6476 Backpatch-through: 17 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/d389415ffad509f0de1342e6ebbb5d5c62dbedef Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/bin/pg_basebackup/pg_createsubscriber.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 3+ messages in thread
* pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 3+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_createsubscriber: Obstruct SQL injection via subscription names. drop_existing_subscription() neglected to escape the subscription name when generating its query string. To fix, use PQescapeIdentifier() to construct a properly escaped name, and use it in the ALTER SUBSCRIPTION and DROP SUBSCRIPTION commands. Reported-by: Yu Kunpeng <yu443940816@live.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Security: CVE-2026-6476 Backpatch-through: 17 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/c2e44c370edc003367e94bde137c6d9cfab5919c Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/bin/pg_basebackup/pg_createsubscriber.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 3+ messages in thread
* pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 3+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pg_createsubscriber: Obstruct SQL injection via subscription names. drop_existing_subscription() neglected to escape the subscription name when generating its query string. To fix, use PQescapeIdentifier() to construct a properly escaped name, and use it in the ALTER SUBSCRIPTION and DROP SUBSCRIPTION commands. Reported-by: Yu Kunpeng <yu443940816@live.com> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Security: CVE-2026-6476 Backpatch-through: 17 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d7de7fa84d2492f15747163cbb2f4c5c110ec4a4 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- src/bin/pg_basebackup/pg_createsubscriber.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2026-05-11 12:19 UTC | newest] Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-05-11 12:19 pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: pg_createsubscriber: Obstruct SQL injection via subscription nam Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox