agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Guard against overlength time zone abbreviations in to_char(). 4+ messages / 1 participants [nested] [flat]
* pgsql: Guard against overlength time zone abbreviations in to_char(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Guard against overlength time zone abbreviations in to_char(). While typical abbreviations are only a few bytes long, a user-supplied time_zone setting could specify a much longer abbreviation, enough to overflow to_char's allocation of 12 bytes per format character. If so, throw an error in the same style as commit 9241c84cb (CVE-2015-0241). Reported-by: Hcamael <baiyjrh@gmail.com> Reported-by: Amjad Shahzad <amjadshahzad2000@gmail.com> Reported-by: Tan Zhen of AntAISecurityLab <TanZhen.AntAI@outlook.com> Reported-by: Tomer Fichman <tomer@irregular.com> Reported-by: Zheng Yu <zheng@depthfirst.com> Reported-by: Amy Burnett (OpenAI Codex Security) Reported-by: Rick de Jager <rick@v12.sh> Reported-by: Heewon Song <asteria121@78researchlab.com> Reported-by: Sylvie Mayer <smayer@cloudflare.com> Reported-by: Aleksander Alekseev <aleksander@tigerdata.com> Reported-by: Hillai Ben Sasson <hillai.bensasson@wiz.io> Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14669 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/3d724bf4fde67a2931733a5143b7d6c12b23990c Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Guard against overlength time zone abbreviations in to_char(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Guard against overlength time zone abbreviations in to_char(). While typical abbreviations are only a few bytes long, a user-supplied time_zone setting could specify a much longer abbreviation, enough to overflow to_char's allocation of 12 bytes per format character. If so, throw an error in the same style as commit 9241c84cb (CVE-2015-0241). Reported-by: Hcamael <baiyjrh@gmail.com> Reported-by: Amjad Shahzad <amjadshahzad2000@gmail.com> Reported-by: Tan Zhen of AntAISecurityLab <TanZhen.AntAI@outlook.com> Reported-by: Tomer Fichman <tomer@irregular.com> Reported-by: Zheng Yu <zheng@depthfirst.com> Reported-by: Amy Burnett (OpenAI Codex Security) Reported-by: Rick de Jager <rick@v12.sh> Reported-by: Heewon Song <asteria121@78researchlab.com> Reported-by: Sylvie Mayer <smayer@cloudflare.com> Reported-by: Aleksander Alekseev <aleksander@tigerdata.com> Reported-by: Hillai Ben Sasson <hillai.bensasson@wiz.io> Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14669 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/3294ab83947270a44f680a1725383e6521315b70 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Guard against overlength time zone abbreviations in to_char(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Guard against overlength time zone abbreviations in to_char(). While typical abbreviations are only a few bytes long, a user-supplied time_zone setting could specify a much longer abbreviation, enough to overflow to_char's allocation of 12 bytes per format character. If so, throw an error in the same style as commit 9241c84cb (CVE-2015-0241). Reported-by: Hcamael <baiyjrh@gmail.com> Reported-by: Amjad Shahzad <amjadshahzad2000@gmail.com> Reported-by: Tan Zhen of AntAISecurityLab <TanZhen.AntAI@outlook.com> Reported-by: Tomer Fichman <tomer@irregular.com> Reported-by: Zheng Yu <zheng@depthfirst.com> Reported-by: Amy Burnett (OpenAI Codex Security) Reported-by: Rick de Jager <rick@v12.sh> Reported-by: Heewon Song <asteria121@78researchlab.com> Reported-by: Sylvie Mayer <smayer@cloudflare.com> Reported-by: Aleksander Alekseev <aleksander@tigerdata.com> Reported-by: Hillai Ben Sasson <hillai.bensasson@wiz.io> Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14669 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4fafe23805c4c75c2e85e8a0c1675fd17d92977b Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Guard against overlength time zone abbreviations in to_char(). @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Guard against overlength time zone abbreviations in to_char(). While typical abbreviations are only a few bytes long, a user-supplied time_zone setting could specify a much longer abbreviation, enough to overflow to_char's allocation of 12 bytes per format character. If so, throw an error in the same style as commit 9241c84cb (CVE-2015-0241). Reported-by: Hcamael <baiyjrh@gmail.com> Reported-by: Amjad Shahzad <amjadshahzad2000@gmail.com> Reported-by: Tan Zhen of AntAISecurityLab <TanZhen.AntAI@outlook.com> Reported-by: Tomer Fichman <tomer@irregular.com> Reported-by: Zheng Yu <zheng@depthfirst.com> Reported-by: Amy Burnett (OpenAI Codex Security) Reported-by: Rick de Jager <rick@v12.sh> Reported-by: Heewon Song <asteria121@78researchlab.com> Reported-by: Sylvie Mayer <smayer@cloudflare.com> Reported-by: Aleksander Alekseev <aleksander@tigerdata.com> Reported-by: Hillai Ben Sasson <hillai.bensasson@wiz.io> Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14669 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/12a6206864a0ba38dc506644bdb3928beea5256a Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/formatting.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Guard against overlength time zone abbreviations in to_char(). Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Guard against overlength time zone abbreviations in to_char(). Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Guard against overlength time zone abbreviations in to_char(). Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Guard against overlength time zone abbreviations in to_char(). Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox