pgsql: Fix detection of passwords hashed with MD5 or SCRAM-SHA-256

From: Michael Paquier <michael(at)paquier(dot)xyz>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Fix detection of passwords hashed with MD5 or SCRAM-SHA-256
Date: 2019-04-23 06:47:20
Message-ID: E1hIpD6-0002uT-TG@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix detection of passwords hashed with MD5 or SCRAM-SHA-256

This commit fixes a couple of issues related to the way password
verifiers hashed with MD5 or SCRAM-SHA-256 are detected, leading to
being able to store in catalogs passwords which do not follow the
supported hash formats:
- A MD5-hashed entry was checked based on if its header uses "md5" and
if the string length matches what is expected. Unfortunately the code
never checked if the hash only used hexadecimal characters, as reported
by Tom Lane.
- A SCRAM-hashed entry was checked based on only its header, which
should be "SCRAM-SHA-256$", but it never checked for any fields
afterwards, as reported by Jonathan Katz.

Backpatch down to v10, which is where SCRAM has been introduced, and
where password verifiers in plain format have been removed.

Author: Jonathan Katz
Reviewed-by: Tom Lane, Michael Paquier
Discussion: https://postgr.es/m/016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org
Backpatch-through: 10

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/ccae190b916f27fbe4079ee4664d34cd1be47b79

Modified Files
--------------
src/backend/libpq/auth-scram.c | 4 +---
src/backend/libpq/crypt.c | 13 +++++++++++--
src/include/common/md5.h | 1 +
src/include/libpq/scram.h | 2 ++
src/test/regress/expected/password.out | 17 ++++++++++++++++-
src/test/regress/sql/password.sql | 13 +++++++++++++
6 files changed, 44 insertions(+), 6 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Laurenz Albe 2019-04-23 06:59:14 Re: pgsql: Allow insert and update tuple routing and COPY for foreign table
Previous Message Andres Freund 2019-04-22 21:51:40 pgsql: Convert gist to compute page level xid horizon on primary.