agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Reject GSSEncRequest after direct SSL connection 4+ messages / 1 participants [nested] [flat]
* pgsql: Reject GSSEncRequest after direct SSL connection @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject GSSEncRequest after direct SSL connection When a direct SSL connection was established, ProcessStartupPacket() still accepted GSSEncRequest messages. The GSSAPI negotiation would then use raw writes and reads, bypassing the TLS encryption layer. After the GSS encryption was established, the connection continued to use TLS. This could betray the HBA rules so as the backend does protocol exchanges inconsistent with the connection policies in place, with TLS taking priority over GSS in the backend. The SSL negotiation path already guarded against attempts to request SSL after a direct SSL request has been processed. The GSS path is now guarded the same way when receiving a startup packet. Reported-by: p4p3r <kbfanta@naver.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Jacob Champion <champion.p@gmail.com> Backpatch-through: 17 Security: CVE-2026-14681 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/3bf185b4bb67e340327276ddf3ae3f9da8034a54 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/tcop/backend_startup.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Reject GSSEncRequest after direct SSL connection @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject GSSEncRequest after direct SSL connection When a direct SSL connection was established, ProcessStartupPacket() still accepted GSSEncRequest messages. The GSSAPI negotiation would then use raw writes and reads, bypassing the TLS encryption layer. After the GSS encryption was established, the connection continued to use TLS. This could betray the HBA rules so as the backend does protocol exchanges inconsistent with the connection policies in place, with TLS taking priority over GSS in the backend. The SSL negotiation path already guarded against attempts to request SSL after a direct SSL request has been processed. The GSS path is now guarded the same way when receiving a startup packet. Reported-by: p4p3r <kbfanta@naver.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Jacob Champion <champion.p@gmail.com> Backpatch-through: 17 Security: CVE-2026-14681 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/bf1bb7e29cb1eddb0fad7422c032abb2b756c281 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/tcop/backend_startup.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Reject GSSEncRequest after direct SSL connection @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject GSSEncRequest after direct SSL connection When a direct SSL connection was established, ProcessStartupPacket() still accepted GSSEncRequest messages. The GSSAPI negotiation would then use raw writes and reads, bypassing the TLS encryption layer. After the GSS encryption was established, the connection continued to use TLS. This could betray the HBA rules so as the backend does protocol exchanges inconsistent with the connection policies in place, with TLS taking priority over GSS in the backend. The SSL negotiation path already guarded against attempts to request SSL after a direct SSL request has been processed. The GSS path is now guarded the same way when receiving a startup packet. Reported-by: p4p3r <kbfanta@naver.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Jacob Champion <champion.p@gmail.com> Backpatch-through: 17 Security: CVE-2026-14681 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/203a48209aa4179d2419fa3243b07998f0373d0a Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/tcop/backend_startup.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
* pgsql: Reject GSSEncRequest after direct SSL connection @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 4+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Reject GSSEncRequest after direct SSL connection When a direct SSL connection was established, ProcessStartupPacket() still accepted GSSEncRequest messages. The GSSAPI negotiation would then use raw writes and reads, bypassing the TLS encryption layer. After the GSS encryption was established, the connection continued to use TLS. This could betray the HBA rules so as the backend does protocol exchanges inconsistent with the connection policies in place, with TLS taking priority over GSS in the backend. The SSL negotiation path already guarded against attempts to request SSL after a direct SSL request has been processed. The GSS path is now guarded the same way when receiving a startup packet. Reported-by: p4p3r <kbfanta@naver.com> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Jacob Champion <champion.p@gmail.com> Backpatch-through: 17 Security: CVE-2026-14681 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/067a64d40f92e4e012db0367f9ff2d2ae45671ca Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/tcop/backend_startup.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Reject GSSEncRequest after direct SSL connection Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject GSSEncRequest after direct SSL connection Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject GSSEncRequest after direct SSL connection Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Reject GSSEncRequest after direct SSL connection Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox