From: | Noah Misch <noah(at)leadboat(dot)com> |
---|---|
To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
Subject: | pgsql: Ignore attempts to \gset into specially treated variables. |
Date: | 2020-11-09 15:35:42 |
Message-ID: | E1kc9Co-0003NT-Qe@gemulon.postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-committers |
Ignore attempts to \gset into specially treated variables.
If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql. Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question. Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE". Back-patch to 9.5
(all supported versions).
Reviewed by Robert Haas. Reported by Nick Cleaton.
Security: CVE-2020-25696
Branch
------
REL_11_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/7b356c78f67099db0bb5dc20663adcedc273c7a0
Modified Files
--------------
src/bin/psql/common.c | 7 +++++++
src/bin/psql/variables.c | 26 ++++++++++++++++++++++++++
src/bin/psql/variables.h | 1 +
src/test/regress/expected/psql.out | 4 ++++
src/test/regress/sql/psql.sql | 3 +++
5 files changed, 41 insertions(+)
From | Date | Subject | |
---|---|---|---|
Next Message | Peter Geoghegan | 2020-11-09 17:01:03 | pgsql: Remove ineffective heapam CHECK_FOR_INTERRUPTS(). |
Previous Message | Peter Eisentraut | 2020-11-09 11:53:01 | pgsql: Translation updates |