agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: pgcrypto: Add option to revert to prior decryption behavior 5+ messages / 1 participants [nested] [flat]
* pgsql: pgcrypto: Add option to revert to prior decryption behavior @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pgcrypto: Add option to revert to prior decryption behavior The previous commit raises an ERROR during PGP operations if OpenSSL does not support the cipher in use. However, any existing messages created with faulty encryption will no longer be accessible via pgp_[sym|pub]_decrypt(). To help users out of this situation, add a new ignore-cipher-failure option which reverts to the broken behavior during decryption only. A faulty encryption wrapper, created by an OpenSSL configuration that does not support the cipher, can then be stripped back off by that same OpenSSL in order to safely reencrypt it. (Note that when OpenSSL does support the cipher, corrupted messages will not be decrypted regardless of the ignore-cipher-failure setting; this is unchanged.) The new tests add a corrupted Blowfish message for both public- and symmetric-key decryption, resulting in the following test matrix: - Blowfish supported, default behavior: fails to decrypt - Blowfish supported, ignore-cipher-failure: fails to decrypt - Blowfish unsupported, default behavior: fails to load cipher - Blowfish unsupported, ignore-cipher-failure: strips faulty encryption The previous commit's change to the pubkey tests is expanded similarly: correctly encrypted messages cannot be decrypted by an OpenSSL that does not support the cipher, regardless of the option's setting, though the failure mode will change. Suggested-by: Noah Misch <noah@leadboat.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-14663 Backpatch-through: 14 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/49e795414848bbd1f5122f64c0645827d8d90313 Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/pgcrypto/expected/pgp-decrypt.out | 26 ++++++++++++++++++ contrib/pgcrypto/expected/pgp-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-info.out | 3 +- contrib/pgcrypto/expected/pgp-pubkey-decrypt.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/pgp-cfb.c | 21 ++++++++++---- contrib/pgcrypto/pgp-decrypt.c | 9 ++++-- contrib/pgcrypto/pgp-encrypt.c | 6 ++-- contrib/pgcrypto/pgp-pgsql.c | 2 ++ contrib/pgcrypto/pgp-pubkey.c | 9 +++++- contrib/pgcrypto/pgp.c | 9 ++++++ contrib/pgcrypto/pgp.h | 7 ++++- contrib/pgcrypto/sql/pgp-decrypt.sql | 26 ++++++++++++++++++ contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql | 27 ++++++++++++++++++ doc/src/sgml/pgcrypto.sgml | 32 ++++++++++++++++++++++ 15 files changed, 254 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: pgcrypto: Add option to revert to prior decryption behavior @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pgcrypto: Add option to revert to prior decryption behavior The previous commit raises an ERROR during PGP operations if OpenSSL does not support the cipher in use. However, any existing messages created with faulty encryption will no longer be accessible via pgp_[sym|pub]_decrypt(). To help users out of this situation, add a new ignore-cipher-failure option which reverts to the broken behavior during decryption only. A faulty encryption wrapper, created by an OpenSSL configuration that does not support the cipher, can then be stripped back off by that same OpenSSL in order to safely reencrypt it. (Note that when OpenSSL does support the cipher, corrupted messages will not be decrypted regardless of the ignore-cipher-failure setting; this is unchanged.) The new tests add a corrupted Blowfish message for both public- and symmetric-key decryption, resulting in the following test matrix: - Blowfish supported, default behavior: fails to decrypt - Blowfish supported, ignore-cipher-failure: fails to decrypt - Blowfish unsupported, default behavior: fails to load cipher - Blowfish unsupported, ignore-cipher-failure: strips faulty encryption The previous commit's change to the pubkey tests is expanded similarly: correctly encrypted messages cannot be decrypted by an OpenSSL that does not support the cipher, regardless of the option's setting, though the failure mode will change. Suggested-by: Noah Misch <noah@leadboat.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-14663 Backpatch-through: 14 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d97b3f58c1c49d396841f86531bf82a315d24e86 Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/pgcrypto/expected/pgp-decrypt.out | 26 ++++++++++++++++++ contrib/pgcrypto/expected/pgp-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-info.out | 3 +- contrib/pgcrypto/expected/pgp-pubkey-decrypt.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/pgp-cfb.c | 21 ++++++++++---- contrib/pgcrypto/pgp-decrypt.c | 9 ++++-- contrib/pgcrypto/pgp-encrypt.c | 6 ++-- contrib/pgcrypto/pgp-pgsql.c | 2 ++ contrib/pgcrypto/pgp-pubkey.c | 9 +++++- contrib/pgcrypto/pgp.c | 9 ++++++ contrib/pgcrypto/pgp.h | 7 ++++- contrib/pgcrypto/sql/pgp-decrypt.sql | 26 ++++++++++++++++++ contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql | 27 ++++++++++++++++++ doc/src/sgml/pgcrypto.sgml | 32 ++++++++++++++++++++++ 15 files changed, 254 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: pgcrypto: Add option to revert to prior decryption behavior @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pgcrypto: Add option to revert to prior decryption behavior The previous commit raises an ERROR during PGP operations if OpenSSL does not support the cipher in use. However, any existing messages created with faulty encryption will no longer be accessible via pgp_[sym|pub]_decrypt(). To help users out of this situation, add a new ignore-cipher-failure option which reverts to the broken behavior during decryption only. A faulty encryption wrapper, created by an OpenSSL configuration that does not support the cipher, can then be stripped back off by that same OpenSSL in order to safely reencrypt it. (Note that when OpenSSL does support the cipher, corrupted messages will not be decrypted regardless of the ignore-cipher-failure setting; this is unchanged.) The new tests add a corrupted Blowfish message for both public- and symmetric-key decryption, resulting in the following test matrix: - Blowfish supported, default behavior: fails to decrypt - Blowfish supported, ignore-cipher-failure: fails to decrypt - Blowfish unsupported, default behavior: fails to load cipher - Blowfish unsupported, ignore-cipher-failure: strips faulty encryption The previous commit's change to the pubkey tests is expanded similarly: correctly encrypted messages cannot be decrypted by an OpenSSL that does not support the cipher, regardless of the option's setting, though the failure mode will change. Suggested-by: Noah Misch <noah@leadboat.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-14663 Backpatch-through: 14 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4c5128ca0b308c37a91ea7dcc4c10a98c672d592 Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/pgcrypto/expected/pgp-decrypt.out | 26 ++++++++++++++++++ contrib/pgcrypto/expected/pgp-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-info.out | 3 +- contrib/pgcrypto/expected/pgp-pubkey-decrypt.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/pgp-cfb.c | 21 ++++++++++---- contrib/pgcrypto/pgp-decrypt.c | 9 ++++-- contrib/pgcrypto/pgp-encrypt.c | 6 ++-- contrib/pgcrypto/pgp-pgsql.c | 2 ++ contrib/pgcrypto/pgp-pubkey.c | 9 +++++- contrib/pgcrypto/pgp.c | 9 ++++++ contrib/pgcrypto/pgp.h | 7 ++++- contrib/pgcrypto/sql/pgp-decrypt.sql | 26 ++++++++++++++++++ contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql | 27 ++++++++++++++++++ doc/src/sgml/pgcrypto.sgml | 32 ++++++++++++++++++++++ 15 files changed, 254 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: pgcrypto: Add option to revert to prior decryption behavior @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pgcrypto: Add option to revert to prior decryption behavior The previous commit raises an ERROR during PGP operations if OpenSSL does not support the cipher in use. However, any existing messages created with faulty encryption will no longer be accessible via pgp_[sym|pub]_decrypt(). To help users out of this situation, add a new ignore-cipher-failure option which reverts to the broken behavior during decryption only. A faulty encryption wrapper, created by an OpenSSL configuration that does not support the cipher, can then be stripped back off by that same OpenSSL in order to safely reencrypt it. (Note that when OpenSSL does support the cipher, corrupted messages will not be decrypted regardless of the ignore-cipher-failure setting; this is unchanged.) The new tests add a corrupted Blowfish message for both public- and symmetric-key decryption, resulting in the following test matrix: - Blowfish supported, default behavior: fails to decrypt - Blowfish supported, ignore-cipher-failure: fails to decrypt - Blowfish unsupported, default behavior: fails to load cipher - Blowfish unsupported, ignore-cipher-failure: strips faulty encryption The previous commit's change to the pubkey tests is expanded similarly: correctly encrypted messages cannot be decrypted by an OpenSSL that does not support the cipher, regardless of the option's setting, though the failure mode will change. Suggested-by: Noah Misch <noah@leadboat.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-14663 Backpatch-through: 14 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/7eed42aa88053ce9319f249fc70a46181c026a4b Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/pgcrypto/expected/pgp-decrypt.out | 26 ++++++++++++++++++ contrib/pgcrypto/expected/pgp-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-info.out | 3 +- contrib/pgcrypto/expected/pgp-pubkey-decrypt.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/pgp-cfb.c | 21 ++++++++++---- contrib/pgcrypto/pgp-decrypt.c | 9 ++++-- contrib/pgcrypto/pgp-encrypt.c | 6 ++-- contrib/pgcrypto/pgp-pgsql.c | 2 ++ contrib/pgcrypto/pgp-pubkey.c | 9 +++++- contrib/pgcrypto/pgp.c | 9 ++++++ contrib/pgcrypto/pgp.h | 7 ++++- contrib/pgcrypto/sql/pgp-decrypt.sql | 26 ++++++++++++++++++ contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql | 27 ++++++++++++++++++ doc/src/sgml/pgcrypto.sgml | 32 ++++++++++++++++++++++ 15 files changed, 254 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: pgcrypto: Add option to revert to prior decryption behavior @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org pgcrypto: Add option to revert to prior decryption behavior The previous commit raises an ERROR during PGP operations if OpenSSL does not support the cipher in use. However, any existing messages created with faulty encryption will no longer be accessible via pgp_[sym|pub]_decrypt(). To help users out of this situation, add a new ignore-cipher-failure option which reverts to the broken behavior during decryption only. A faulty encryption wrapper, created by an OpenSSL configuration that does not support the cipher, can then be stripped back off by that same OpenSSL in order to safely reencrypt it. (Note that when OpenSSL does support the cipher, corrupted messages will not be decrypted regardless of the ignore-cipher-failure setting; this is unchanged.) The new tests add a corrupted Blowfish message for both public- and symmetric-key decryption, resulting in the following test matrix: - Blowfish supported, default behavior: fails to decrypt - Blowfish supported, ignore-cipher-failure: fails to decrypt - Blowfish unsupported, default behavior: fails to load cipher - Blowfish unsupported, ignore-cipher-failure: strips faulty encryption The previous commit's change to the pubkey tests is expanded similarly: correctly encrypted messages cannot be decrypted by an OpenSSL that does not support the cipher, regardless of the option's setting, though the failure mode will change. Suggested-by: Noah Misch <noah@leadboat.com> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-14663 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/ba2a63faffff826d3e2c25cf6396904fc8a4e2fd Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/pgcrypto/expected/pgp-decrypt.out | 26 ++++++++++++++++++ contrib/pgcrypto/expected/pgp-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-info.out | 3 +- contrib/pgcrypto/expected/pgp-pubkey-decrypt.out | 30 ++++++++++++++++++++ contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out | 30 ++++++++++++++++++++ contrib/pgcrypto/pgp-cfb.c | 21 ++++++++++---- contrib/pgcrypto/pgp-decrypt.c | 9 ++++-- contrib/pgcrypto/pgp-encrypt.c | 6 ++-- contrib/pgcrypto/pgp-pgsql.c | 2 ++ contrib/pgcrypto/pgp-pubkey.c | 9 +++++- contrib/pgcrypto/pgp.c | 9 ++++++ contrib/pgcrypto/pgp.h | 7 ++++- contrib/pgcrypto/sql/pgp-decrypt.sql | 26 ++++++++++++++++++ contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql | 27 ++++++++++++++++++ doc/src/sgml/pgcrypto.sgml | 32 ++++++++++++++++++++++ 15 files changed, 254 insertions(+), 13 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: pgcrypto: Add option to revert to prior decryption behavior Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: pgcrypto: Add option to revert to prior decryption behavior Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: pgcrypto: Add option to revert to prior decryption behavior Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: pgcrypto: Add option to revert to prior decryption behavior Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: pgcrypto: Add option to revert to prior decryption behavior Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox