mirror of
https://github.com/postgres/postgres.git
synced 2026-03-09 17:50:43 -04:00
67a2fbb8f9
A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix, introduce a new "restricted" mode in psql that blocks all meta-commands (except for \unrestrict to exit the mode), and teach pg_dump, pg_dumpall, and pg_restore to use this mode in plain-text dumps. While at it, encourage users to only restore dumps generated from trusted servers or to inspect it beforehand, since restoring causes the destination to execute arbitrary code of the source superusers' choice. However, the client running the dump and restore needn't trust the source or destination superusers. Reported-by: Martin Rakhmanov Reported-by: Matthieu Denais <litezeraw@gmail.com> Reported-by: RyotaK <ryotak.mail@gmail.com> Suggested-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Michael Paquier <michael@paquier.xyz> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Security: CVE-2025-8714 Backpatch-through: 13 |
||
|---|---|---|
| .. | ||
| initdb | ||
| pg_amcheck | ||
| pg_archivecleanup | ||
| pg_basebackup | ||
| pg_checksums | ||
| pg_combinebackup | ||
| pg_config | ||
| pg_controldata | ||
| pg_ctl | ||
| pg_dump | ||
| pg_resetwal | ||
| pg_rewind | ||
| pg_test_fsync | ||
| pg_test_timing | ||
| pg_upgrade | ||
| pg_verifybackup | ||
| pg_waldump | ||
| pg_walsummary | ||
| pgbench | ||
| pgevent | ||
| psql | ||
| scripts | ||
| Makefile | ||
| meson.build | ||