]> git.ipfire.org Git - thirdparty/postgresql.git/commit
Ignore attempts to \gset into specially treated variables.
authorNoah Misch <noah@leadboat.com>
Mon, 9 Nov 2020 15:32:09 +0000 (07:32 -0800)
committerNoah Misch <noah@leadboat.com>
Mon, 9 Nov 2020 15:32:13 +0000 (07:32 -0800)
commit3855e5b4767b189d4daf6e9a774e4e64be72e0ff
tree62ac627c93c2f4c42795f0078213b8de3e080bf5
parentac8f6243cb002f3386322fb231a0c5daa637941d
Ignore attempts to \gset into specially treated variables.

If an interactive psql session used \gset when querying a compromised
server, the attacker could execute arbitrary code as the operating
system account running psql.  Using a prefix not found among specially
treated variables, e.g. every lowercase string, precluded the attack.
Fix by issuing a warning and setting no variable for the column in
question.  Users wanting the old behavior can use a prefix and then a
meta-command like "\set HISTSIZE :prefix_HISTSIZE".  Back-patch to 9.5
(all supported versions).

Reviewed by Robert Haas.  Reported by Nick Cleaton.

Security: CVE-2020-25696
src/bin/psql/common.c
src/bin/psql/variables.c
src/bin/psql/variables.h
src/test/regress/expected/psql.out
src/test/regress/sql/psql.sql