agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: pgcrypto: Add option to revert to prior decryption behavior
Date: Mon, 10 Aug 2026 13:41:30 +0000
Message-ID: <E1wtQFu-00000000yHt-0F1d@gemulon.postgresql.org> (raw)
pgcrypto: Add option to revert to prior decryption behavior
The previous commit raises an ERROR during PGP operations if OpenSSL
does not support the cipher in use. However, any existing messages
created with faulty encryption will no longer be accessible via
pgp_[sym|pub]_decrypt().
To help users out of this situation, add a new ignore-cipher-failure
option which reverts to the broken behavior during decryption only. A
faulty encryption wrapper, created by an OpenSSL configuration that does
not support the cipher, can then be stripped back off by that same
OpenSSL in order to safely reencrypt it. (Note that when OpenSSL does
support the cipher, corrupted messages will not be decrypted regardless
of the ignore-cipher-failure setting; this is unchanged.)
The new tests add a corrupted Blowfish message for both public- and
symmetric-key decryption, resulting in the following test matrix:
- Blowfish supported, default behavior: fails to decrypt
- Blowfish supported, ignore-cipher-failure: fails to decrypt
- Blowfish unsupported, default behavior: fails to load cipher
- Blowfish unsupported, ignore-cipher-failure: strips faulty encryption
The previous commit's change to the pubkey tests is expanded similarly:
correctly encrypted messages cannot be decrypted by an OpenSSL that does
not support the cipher, regardless of the option's setting, though the
failure mode will change.
Suggested-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Noah Misch <noah@leadboat.com>
Security: CVE-2026-14663
Backpatch-through: 14
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/ba2a63faffff826d3e2c25cf6396904fc8a4e2fd
Author: Jacob Champion <jchampion@postgresql.org>
Modified Files
--------------
contrib/pgcrypto/expected/pgp-decrypt.out | 26 ++++++++++++++++++
contrib/pgcrypto/expected/pgp-decrypt_1.out | 30 ++++++++++++++++++++
contrib/pgcrypto/expected/pgp-info.out | 3 +-
contrib/pgcrypto/expected/pgp-pubkey-decrypt.out | 30 ++++++++++++++++++++
contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out | 30 ++++++++++++++++++++
contrib/pgcrypto/pgp-cfb.c | 21 ++++++++++----
contrib/pgcrypto/pgp-decrypt.c | 9 ++++--
contrib/pgcrypto/pgp-encrypt.c | 6 ++--
contrib/pgcrypto/pgp-pgsql.c | 2 ++
contrib/pgcrypto/pgp-pubkey.c | 9 +++++-
contrib/pgcrypto/pgp.c | 9 ++++++
contrib/pgcrypto/pgp.h | 7 ++++-
contrib/pgcrypto/sql/pgp-decrypt.sql | 26 ++++++++++++++++++
contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql | 27 ++++++++++++++++++
doc/src/sgml/pgcrypto.sgml | 32 ++++++++++++++++++++++
15 files changed, 254 insertions(+), 13 deletions(-)
view thread (5+ messages)
Message-ID: <E1wtQFu-00000000yHt-0F1d@gemulon.postgresql.org>
Permalink: ../E1wtQFu-00000000yHt-0F1d@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtQFu-00000000yHt-0F1d@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: pgcrypto: Add option to revert to prior decryption behavior
In-Reply-To: <E1wtQFu-00000000yHt-0F1d@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox