mirror of
https://github.com/postgres/postgres.git
synced 2026-06-27 09:22:52 -04:00
f7a191f537
The handling of SSL and GSS negotiation messages in ProcessStartupPacket() could cause a recursion of the backend, ultimately crashing the server as the negotiation attempts were not tracked across multiple calls processing startup packets. A malicious client could therefore alternate rejected SSL and GSS requests indefinitely, each adding a stack frame, until the backend crashed with a stack overflow, taking down a server. This commit addresses this issue by modifying ProcessStartupPacket() so as processed negotiation attempts are tracked, preventing infinite recursive attempts. A TAP test is added to check this problem, where multiple SSL and GSS negotiated attempts are stacked. Reported-by: Calif.io in collaboration with Claude and Anthropic Research Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Security: CVE-2026-6479 Backpatch-through: 14 |
||
|---|---|---|
| .. | ||
| backend_startup.c | ||
| cmdtag.c | ||
| dest.c | ||
| fastpath.c | ||
| Makefile | ||
| meson.build | ||
| postgres.c | ||
| pquery.c | ||
| utility.c | ||