database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Reject GSSEncRequest after direct SSL connection

Browse Source 
When a direct SSL connection was established, ProcessStartupPacket()
still accepted GSSEncRequest messages.  The GSSAPI negotiation would
then use raw writes and reads, bypassing the TLS encryption layer.
After the GSS encryption was established, the connection continued to
use TLS.  This could betray the HBA rules so as the backend does
protocol exchanges inconsistent with the connection policies in place,
with TLS taking priority over GSS in the backend.

The SSL negotiation path already guarded against attempts to request
SSL after a direct SSL request has been processed.  The GSS path is now
guarded the same way when receiving a startup packet.

Reported-by: p4p3r <kbfanta@naver.com>
Author: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Jacob Champion <champion.p@gmail.com>
Backpatch-through: 17
Security: CVE-2026-14681
This commit is contained in:
Michael Paquier
2026-08-10 06:38:11 -07:00
committed by Noah Misch
parent a14ba29b15
commit 203a48209a
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/tcop/backend_startup.c
View File

@@ -649,8 +649,13 @@ retry:
char GSSok = 'N';
#ifdef ENABLE_GSS
/* No GSSAPI encryption when on Unix socket */
if (port->laddr.addr.ss_family != AF_UNIX)
/*
* No GSSAPI encryption when on Unix socket.
*
* Also no GSS negotiation if we already have a direct SSL connection.
*/
if (port->laddr.addr.ss_family != AF_UNIX && !port->ssl_in_use)
GSSok = 'G';
#endif