diff options
| author | Noah Misch <noah@leadboat.com> | 2016-08-08 10:07:46 -0400 |
|---|---|---|
| committer | Noah Misch <noah@leadboat.com> | 2016-08-08 10:07:54 -0400 |
| commit | a2385cac135bb8498a12b1af2cde18244c7be2b1 (patch) | |
| tree | 129e12a8a5ec3b792144f0a7cee0f60907fb24ed /contrib/pg_upgrade/pg_upgrade.c | |
| parent | d2dd5df5142b1faf2c96ddf5f0c0b358b14f1ac9 (diff) | |
Obstruct shell, SQL, and conninfo injection via database and role names.
Due to simplistic quoting and confusion of database names with conninfo
strings, roles with the CREATEDB or CREATEROLE option could escalate to
superuser privileges when a superuser next ran certain maintenance
commands. The new coding rule for PQconnectdbParams() calls, documented
at conninfo_array_parse(), is to pass expand_dbname=true and wrap
literal database names in a trivial connection string. Escape
zero-length values in appendConnStrVal(). Back-patch to 9.1 (all
supported versions).
Nathan Bossart, Michael Paquier, and Noah Misch. Reviewed by Peter
Eisentraut. Reported by Nathan Bossart.
Security: CVE-2016-5424
Diffstat (limited to 'contrib/pg_upgrade/pg_upgrade.c')
| -rw-r--r-- | contrib/pg_upgrade/pg_upgrade.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/contrib/pg_upgrade/pg_upgrade.c b/contrib/pg_upgrade/pg_upgrade.c index ad4da56cff2..2e73a25f46d 100644 --- a/contrib/pg_upgrade/pg_upgrade.c +++ b/contrib/pg_upgrade/pg_upgrade.c @@ -359,9 +359,9 @@ prepare_new_cluster(void) */ prep_status("Analyzing all rows in the new cluster"); exec_prog(true, - SYSTEMQUOTE "\"%s/vacuumdb\" --port %d --username \"%s\" " + SYSTEMQUOTE "\"%s/vacuumdb\" --port %d --username %s " "--all --analyze >> \"%s\" 2>&1" SYSTEMQUOTE, - new_cluster.bindir, new_cluster.port, os_info.user, + new_cluster.bindir, new_cluster.port, os_info.user_shell_arg, #ifndef WIN32 log_opts.filename #else @@ -378,9 +378,9 @@ prepare_new_cluster(void) */ prep_status("Freezing all rows on the new cluster"); exec_prog(true, - SYSTEMQUOTE "\"%s/vacuumdb\" --port %d --username \"%s\" " + SYSTEMQUOTE "\"%s/vacuumdb\" --port %d --username %s " "--all --freeze >> \"%s\" 2>&1" SYSTEMQUOTE, - new_cluster.bindir, new_cluster.port, os_info.user, + new_cluster.bindir, new_cluster.port, os_info.user_shell_arg, #ifndef WIN32 log_opts.filename #else @@ -421,9 +421,10 @@ prepare_new_databases(void) exec_prog(true, SYSTEMQUOTE "\"%s/psql\" --set ON_ERROR_STOP=on " /* --no-psqlrc prevents AUTOCOMMIT=off */ - "--no-psqlrc --port %d --username \"%s\" " + "--no-psqlrc --port %d --username %s " "-f \"%s/%s\" --dbname template1 >> \"%s\"" SYSTEMQUOTE, - new_cluster.bindir, new_cluster.port, os_info.user, os_info.cwd, + new_cluster.bindir, new_cluster.port, + os_info.user_shell_arg, os_info.cwd, GLOBALS_DUMP_FILE, #ifndef WIN32 log_opts.filename @@ -458,9 +459,10 @@ create_new_objects(void) prep_status("Restoring database schema to new cluster"); exec_prog(true, SYSTEMQUOTE "\"%s/psql\" --set ON_ERROR_STOP=on " - "--no-psqlrc --port %d --username \"%s\" " + "--no-psqlrc --port %d --username %s " "-f \"%s/%s\" --dbname template1 >> \"%s\"" SYSTEMQUOTE, - new_cluster.bindir, new_cluster.port, os_info.user, os_info.cwd, + new_cluster.bindir, new_cluster.port, + os_info.user_shell_arg, os_info.cwd, DB_DUMP_FILE, #ifndef WIN32 log_opts.filename |