agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Prevent path traversal in pg_basebackup and pg_rewind 6+ messages / 1 participants [nested] [flat]
* pgsql: Prevent path traversal in pg_basebackup and pg_rewind @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Prevent path traversal in pg_basebackup and pg_rewind pg_rewind and pg_basebackup could be fed paths from rogue endpoints that could overwrite the contents of the client when received, achieving path traversal. There were two areas in the tree that were sensitive to this problem: - pg_basebackup, through the astreamer code, where no validation was performed before building an output path when streaming tar data. This is an issue in v15 and newer versions. - pg_rewind file operations for paths received through libpq, for all the stable branches supported. In order to address this problem, this commit adds a helper function in path.c, that reuses path_is_relative_and_below_cwd() after applying canonicalize_path(). This can be used to validate the paths received from a connection point. A path is considered invalid if any of the two following conditions is satisfied: - The path is absolute. - The path includes a direct parent-directory reference. Reported-by: XlabAI Team of Tencent Xuanwu Lab Reported-by: Valery Gubanov <valerygubanov95@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Backpatch-through: 14 Security: CVE-2026-6475 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/a1063eecedf379de5dad73f9bd6e856ad5c114fb Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/bin/pg_rewind/file_ops.c | 23 +++++++++++++++++++++++ src/fe_utils/astreamer_file.c | 12 ++++++++++++ src/fe_utils/astreamer_tar.c | 4 ++++ src/include/port.h | 1 + src/port/path.c | 17 +++++++++++++++++ 5 files changed, 57 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Prevent path traversal in pg_basebackup and pg_rewind @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Prevent path traversal in pg_basebackup and pg_rewind pg_rewind and pg_basebackup could be fed paths from rogue endpoints that could overwrite the contents of the client when received, achieving path traversal. There were two areas in the tree that were sensitive to this problem: - pg_basebackup, through the astreamer code, where no validation was performed before building an output path when streaming tar data. This is an issue in v15 and newer versions. - pg_rewind file operations for paths received through libpq, for all the stable branches supported. In order to address this problem, this commit adds a helper function in path.c, that reuses path_is_relative_and_below_cwd() after applying canonicalize_path(). This can be used to validate the paths received from a connection point. A path is considered invalid if any of the two following conditions is satisfied: - The path is absolute. - The path includes a direct parent-directory reference. Reported-by: XlabAI Team of Tencent Xuanwu Lab Reported-by: Valery Gubanov <valerygubanov95@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Backpatch-through: 14 Security: CVE-2026-6475 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/6a67c540a6dc4e391560789dd29cdbb246e659e0 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/bin/pg_rewind/file_ops.c | 23 +++++++++++++++++++++++ src/fe_utils/astreamer_file.c | 12 ++++++++++++ src/fe_utils/astreamer_tar.c | 4 ++++ src/include/port.h | 1 + src/port/path.c | 17 +++++++++++++++++ 5 files changed, 57 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Prevent path traversal in pg_basebackup and pg_rewind @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Prevent path traversal in pg_basebackup and pg_rewind pg_rewind and pg_basebackup could be fed paths from rogue endpoints that could overwrite the contents of the client when received, achieving path traversal. There were two areas in the tree that were sensitive to this problem: - pg_basebackup, through the astreamer code, where no validation was performed before building an output path when streaming tar data. This is an issue in v15 and newer versions. - pg_rewind file operations for paths received through libpq, for all the stable branches supported. In order to address this problem, this commit adds a helper function in path.c, that reuses path_is_relative_and_below_cwd() after applying canonicalize_path(). This can be used to validate the paths received from a connection point. A path is considered invalid if any of the two following conditions is satisfied: - The path is absolute. - The path includes a direct parent-directory reference. Reported-by: XlabAI Team of Tencent Xuanwu Lab Reported-by: Valery Gubanov <valerygubanov95@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Backpatch-through: 14 Security: CVE-2026-6475 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/8f881e188bba9e9d8d63ca0b42cb2597ba828e03 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/bin/pg_basebackup/bbstreamer_file.c | 12 ++++++++++++ src/bin/pg_basebackup/bbstreamer_tar.c | 3 +++ src/bin/pg_rewind/file_ops.c | 23 +++++++++++++++++++++++ src/include/port.h | 1 + src/port/path.c | 17 +++++++++++++++++ 5 files changed, 56 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Prevent path traversal in pg_basebackup and pg_rewind @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Prevent path traversal in pg_basebackup and pg_rewind pg_rewind and pg_basebackup could be fed paths from rogue endpoints that could overwrite the contents of the client when received, achieving path traversal. There were two areas in the tree that were sensitive to this problem: - pg_basebackup, through the astreamer code, where no validation was performed before building an output path when streaming tar data. This is an issue in v15 and newer versions. - pg_rewind file operations for paths received through libpq, for all the stable branches supported. In order to address this problem, this commit adds a helper function in path.c, that reuses path_is_relative_and_below_cwd() after applying canonicalize_path(). This can be used to validate the paths received from a connection point. A path is considered invalid if any of the two following conditions is satisfied: - The path is absolute. - The path includes a direct parent-directory reference. Reported-by: XlabAI Team of Tencent Xuanwu Lab Reported-by: Valery Gubanov <valerygubanov95@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Backpatch-through: 14 Security: CVE-2026-6475 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/6778af13e283c593fe0c16aeb6ed953a080e582b Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/bin/pg_basebackup/bbstreamer_file.c | 12 ++++++++++++ src/bin/pg_basebackup/bbstreamer_tar.c | 3 +++ src/bin/pg_rewind/file_ops.c | 23 +++++++++++++++++++++++ src/include/port.h | 1 + src/port/path.c | 17 +++++++++++++++++ 5 files changed, 56 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Prevent path traversal in pg_basebackup and pg_rewind @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Prevent path traversal in pg_basebackup and pg_rewind pg_rewind and pg_basebackup could be fed paths from rogue endpoints that could overwrite the contents of the client when received, achieving path traversal. There were two areas in the tree that were sensitive to this problem: - pg_basebackup, through the astreamer code, where no validation was performed before building an output path when streaming tar data. This is an issue in v15 and newer versions. - pg_rewind file operations for paths received through libpq, for all the stable branches supported. In order to address this problem, this commit adds a helper function in path.c, that reuses path_is_relative_and_below_cwd() after applying canonicalize_path(). This can be used to validate the paths received from a connection point. A path is considered invalid if any of the two following conditions is satisfied: - The path is absolute. - The path includes a direct parent-directory reference. Reported-by: XlabAI Team of Tencent Xuanwu Lab Reported-by: Valery Gubanov <valerygubanov95@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Backpatch-through: 14 Security: CVE-2026-6475 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/0c83fe8e4c84471e32254de2a1ef5e52921bebb7 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/bin/pg_basebackup/bbstreamer_file.c | 12 ++++++++++++ src/bin/pg_basebackup/bbstreamer_tar.c | 3 +++ src/bin/pg_rewind/file_ops.c | 23 +++++++++++++++++++++++ src/include/port.h | 1 + src/port/path.c | 17 +++++++++++++++++ 5 files changed, 56 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Prevent path traversal in pg_basebackup and pg_rewind @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Prevent path traversal in pg_basebackup and pg_rewind pg_rewind and pg_basebackup could be fed paths from rogue endpoints that could overwrite the contents of the client when received, achieving path traversal. There were two areas in the tree that were sensitive to this problem: - pg_basebackup, through the astreamer code, where no validation was performed before building an output path when streaming tar data. This is an issue in v15 and newer versions. - pg_rewind file operations for paths received through libpq, for all the stable branches supported. In order to address this problem, this commit adds a helper function in path.c, that reuses path_is_relative_and_below_cwd() after applying canonicalize_path(). This can be used to validate the paths received from a connection point. A path is considered invalid if any of the two following conditions is satisfied: - The path is absolute. - The path includes a direct parent-directory reference. Reported-by: XlabAI Team of Tencent Xuanwu Lab Reported-by: Valery Gubanov <valerygubanov95@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Backpatch-through: 14 Security: CVE-2026-6475 Branch ------ REL_14_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/498829dca45ad207a23954fe2e5a30ed2ef4b363 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/bin/pg_rewind/file_ops.c | 23 +++++++++++++++++++++++ src/include/port.h | 1 + src/port/path.c | 17 +++++++++++++++++ 3 files changed, 41 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-05-11 12:19 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-05-11 12:19 pgsql: Prevent path traversal in pg_basebackup and pg_rewind Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Prevent path traversal in pg_basebackup and pg_rewind Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Prevent path traversal in pg_basebackup and pg_rewind Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Prevent path traversal in pg_basebackup and pg_rewind Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Prevent path traversal in pg_basebackup and pg_rewind Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Prevent path traversal in pg_basebackup and pg_rewind Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox