upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-02-23 18:04:41 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
postgresql/src/include
History
Michael Paquier 15fe91e70e Fix detection of passwords hashed with MD5 or SCRAM-SHA-256 
This commit fixes a couple of issues related to the way password
verifiers hashed with MD5 or SCRAM-SHA-256 are detected, leading to
being able to store in catalogs passwords which do not follow the
supported hash formats:
- A MD5-hashed entry was checked based on if its header uses "md5" and
if the string length matches what is expected.  Unfortunately the code
never checked if the hash only used hexadecimal characters, as reported
by Tom Lane.
- A SCRAM-hashed entry was checked based on only its header, which
should be "SCRAM-SHA-256$", but it never checked for any fields
afterwards, as reported by Jonathan Katz.

Backpatch down to v10, which is where SCRAM has been introduced, and
where password verifiers in plain format have been removed.

Author: Jonathan Katz
Reviewed-by: Tom Lane, Michael Paquier
Discussion: https://postgr.es/m/016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org
Backpatch-through: 10
2019-04-23 15:43:38 +09:00
..
access Fix WAL format incompatibility introduced by backpatching of 52ac6cd2d0 2019-03-24 15:41:32 +03:00
bootstrap Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
catalog Fix missing role dependencies for some schema and type ACLs. 2018-11-09 20:42:03 -05:00
commands Mark assorted variables PGDLLIMPORT. 2017-12-05 09:24:05 -05:00
common Fix detection of passwords hashed with MD5 or SCRAM-SHA-256 2019-04-23 15:43:38 +09:00
datatype Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
executor Fix failure with initplans used conditionally during EvalPlanQual rechecks. 2018-09-15 13:42:34 -04:00
fe_utils Empty search_path in Autovacuum and non-psql/pgbench clients. 2018-02-26 07:39:47 -08:00
foreign Separate reinitialization of shared parallel-scan state from ExecReScan. 2017-08-30 13:18:16 -04:00
lib Rename rbtree.c functions to use "rbt" prefix not "rb" prefix. 2018-11-06 13:25:24 -05:00
libpq Fix detection of passwords hashed with MD5 or SCRAM-SHA-256 2019-04-23 15:43:38 +09:00
mb Phase 3 of pgindent updates. 2017-06-21 15:35:54 -04:00
nodes Fix handling of targetlist SRFs when scan/join relation is known empty. 2019-03-07 14:21:52 -05:00
optimizer Avoid sharing PARAM_EXEC slots between different levels of NestLoop. 2019-01-11 15:54:09 -05:00
parser Fix INSERT ON CONFLICT UPDATE through a view that isn't just SELECT *. 2018-08-04 19:38:58 -04:00
port Remove overzeleous assertions in pg_atomic_flag code. 2018-04-07 18:30:15 -07:00
portability Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
postmaster Log when a BRIN autosummarization request fails 2018-03-14 12:00:53 -03:00
regex Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
replication Add subtransaction handling for table synchronization workers. 2018-07-16 17:55:13 -04:00
rewrite Fix creation of resjunk tlist entries for inherited mixed UPDATE/DELETE. 2017-11-27 17:54:09 -05:00
snowball Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
statistics Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
storage Consistently test for in-use shared memory. 2019-04-12 22:36:42 -07:00
tcop Fix event triggers for partitioned tables 2018-10-06 19:17:46 -03:00
tsearch Fix serious performance problems in json(b) to_tsvector(). 2017-07-18 12:45:51 -04:00
utils Prevent memory leaks associated with relcache rd_partcheck structures. 2019-04-13 13:22:26 -04:00
.gitignore Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00
c.h Allow btree comparison functions to return INT_MIN. 2018-10-05 16:01:29 -04:00
fmgr.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
funcapi.h Add a utility function to extract variadic function arguments 2017-10-25 07:14:21 -04:00
getaddrinfo.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
getopt_long.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
Makefile Add statistics subdirectory to Makefile. 2017-06-08 11:29:50 -04:00
miscadmin.h Backport: Mark assorted GUC variables as PGDLLIMPORT. 2018-02-22 12:54:45 -08:00
pg_config.h.in Avoid thread-safety problem in ecpglib. 2019-01-21 23:18:58 -05:00
pg_config.h.win32 Stamp 10.7. 2019-02-11 16:19:36 -05:00
pg_config_ext.h.in Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00
pg_config_ext.h.win32 Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00
pg_config_manual.h Fix default minimum value for descending sequences 2017-01-23 14:00:58 -05:00
pg_getopt.h Use our own getopt() on OpenBSD. 2019-01-18 15:06:26 -05:00
pg_trace.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
pgstat.h Avoid counting transaction stats for parallel worker cooperating 2019-04-10 08:47:39 +05:30
pgtar.h Phase 3 of pgindent updates. 2017-06-21 15:35:54 -04:00
pgtime.h Mark assorted variables PGDLLIMPORT. 2017-12-05 09:24:05 -05:00
port.h Fix misc typos in comments. 2019-01-23 13:50:50 +02:00
postgres.h Phase 3 of pgindent updates. 2017-06-21 15:35:54 -04:00
postgres_ext.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
postgres_fe.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
rusagestub.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00
windowapi.h Phase 2 of pgindent updates. 2017-06-21 15:19:25 -04:00