agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Reject GSSEncRequest after direct SSL connection
Date: Mon, 10 Aug 2026 13:41:22 +0000
Message-ID: <E1wtQFm-00000000y4t-2THs@gemulon.postgresql.org> (raw)
Reject GSSEncRequest after direct SSL connection
When a direct SSL connection was established, ProcessStartupPacket()
still accepted GSSEncRequest messages. The GSSAPI negotiation would
then use raw writes and reads, bypassing the TLS encryption layer.
After the GSS encryption was established, the connection continued to
use TLS. This could betray the HBA rules so as the backend does
protocol exchanges inconsistent with the connection policies in place,
with TLS taking priority over GSS in the backend.
The SSL negotiation path already guarded against attempts to request
SSL after a direct SSL request has been processed. The GSS path is now
guarded the same way when receiving a startup packet.
Reported-by: p4p3r <kbfanta@naver.com>
Author: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Jacob Champion <champion.p@gmail.com>
Backpatch-through: 17
Security: CVE-2026-14681
Branch
------
REL_19_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/bf1bb7e29cb1eddb0fad7422c032abb2b756c281
Author: Michael Paquier <michael@paquier.xyz>
Modified Files
--------------
src/backend/tcop/backend_startup.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
view thread (4+ messages) latest in thread
Message-ID: <E1wtQFm-00000000y4t-2THs@gemulon.postgresql.org>
Permalink: ../E1wtQFm-00000000y4t-2THs@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtQFm-00000000y4t-2THs@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Reject GSSEncRequest after direct SSL connection
In-Reply-To: <E1wtQFm-00000000y4t-2THs@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox