You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tom Lane 30547d7913 libpq: reject extraneous data after SSL or GSS encryption handshake. ... libpq collects up to a bufferload of data whenever it reads data from the socket. When SSL or GSS encryption is requested during startup, any additional data received with the server's yes-or-no reply remained in the buffer, and would be treated as already-decrypted data once the encryption handshake completed. Thus, a man-in-the-middle with the ability to inject data into the TCP connection could stuff some cleartext data into the start of a supposedly encryption-protected database session. This could probably be abused to inject faked responses to the client's first few queries, although other details of libpq's behavior make that harder than it sounds. A different line of attack is to exfiltrate the client's password, or other sensitive data that might be sent early in the session. That has been shown to be possible with a server vulnerable to CVE-2021-23214. To fix, throw a protocol-violation error if the internal buffer is not empty after the encryption handshake. Our thanks to Jacob Champion for reporting this problem. Security: CVE-2021-23222		4 years ago
..
backend	Reject extraneous data after SSL or GSS encryption handshake.	4 years ago
bin	Translation updates	4 years ago
common	Fix memory leak in pg_hmac	4 years ago
fe_utils	Fix incautious handling of possibly-miscoded strings in client code.	5 years ago
include	Reject extraneous data after SSL or GSS encryption handshake.	4 years ago
interfaces	libpq: reject extraneous data after SSL or GSS encryption handshake.	4 years ago
makefiles	Add NO_INSTALL option to pgxs	5 years ago
pl	Translation updates	4 years ago
port	AIX: Fix missing libpq symbols by respecting SHLIB_EXPORTS.	5 years ago
template	Further tweaking of PG_SYSROOT heuristics for macOS.	5 years ago
test	Fix handling of NaN values in BRIN minmax multi	4 years ago
timezone	Update time zone data files to tzdata release 2021e.	4 years ago
tools	Avoid race in RelationBuildDesc() affecting CREATE INDEX CONCURRENTLY.	4 years ago
tutorial	doc: Prefer explicit JOIN syntax over old implicit syntax in tutorial	5 years ago
.gitignore	…
DEVELOPERS	…
Makefile	Remove the option to build thread_test.c outside configure.	5 years ago
Makefile.global.in	Add module build directory to the PATH for TAP tests	4 years ago
Makefile.shlib	AIX: Fix missing libpq symbols by respecting SHLIB_EXPORTS.	5 years ago
nls-global.mk	Add errhint_plural() function and make use of it	5 years ago