diff options
| author | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:09 -0800 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2020-11-09 07:32:13 -0800 |
| commit | 7b356c78f67099db0bb5dc20663adcedc273c7a0 (patch) | |
| tree | 60d1b230d22605165cbb39b9a561a6d7804430e3 /src/bin/psql/common.c | |
| parent | 43ebfea5a988582e9edc752cb1e22e929edac03b (diff) | |
| download | postgresql-7b356c78f67099db0bb5dc20663adcedc273c7a0.tar.gz postgresql-7b356c78f67099db0bb5dc20663adcedc273c7a0.zip | |
Ignore attempts to \gset into specially treated variables.
If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql. Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question. Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE". Back-patch to 9.5
(all supported versions).
Reviewed by Robert Haas. Reported by Nick Cleaton.
Security: CVE-2020-25696
Diffstat (limited to 'src/bin/psql/common.c')
| -rw-r--r-- | src/bin/psql/common.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/bin/psql/common.c b/src/bin/psql/common.c index 9b5b8439608..11200cc6a6f 100644 --- a/src/bin/psql/common.c +++ b/src/bin/psql/common.c @@ -942,6 +942,13 @@ StoreQueryTuple(const PGresult *result) /* concatenate prefix and column name */ varname = psprintf("%s%s", pset.gset_prefix, colname); + if (VariableHasHook(pset.vars, varname)) + { + psql_error("attempt to \\gset into specially treated variable \"%s\" ignored\n", + varname); + continue; + } + if (!PQgetisnull(result, 0, i)) value = PQgetvalue(result, 0, i); else |