96 lines
3.7 KiB
Diff
96 lines
3.7 KiB
Diff
From 11da97024abbe76b8c81e3f2375b2a62e9717c67 Mon Sep 17 00:00:00 2001
|
|
From: Noah Misch <noah@leadboat.com>
|
|
Date: Mon, 10 Aug 2020 09:22:54 -0700
|
|
Subject: [PATCH] Empty search_path in logical replication apply worker and
|
|
walsender.
|
|
|
|
This is like CVE-2018-1058 commit
|
|
582edc369cdbd348d68441fc50fa26a84afd0c1a. Today, a malicious user of a
|
|
publisher or subscriber database can invoke arbitrary SQL functions
|
|
under an identity running replication, often a superuser. This fix may
|
|
cause "does not exist" or "no schema has been selected to create in"
|
|
errors in a replication process. After upgrading, consider watching
|
|
server logs for these errors. Objects accruing schema qualification in
|
|
the wake of the earlier commit are unlikely to need further correction.
|
|
Back-patch to v10, which introduced logical replication.
|
|
|
|
Security: CVE-2020-14349
|
|
reason: fix CVE-2020-14349
|
|
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=11da97024abbe76b8c81e3f2375b2a62e9717c67
|
|
|
|
Signed-off-by: Noah Misch <noah@leadboat.com>
|
|
---
|
|
.../libpqwalreceiver/libpqwalreceiver.c | 17 +++++++++++++++++
|
|
src/backend/replication/logical/worker.c | 6 ++++++
|
|
src/test/subscription/t/001_rep_changes.pl | 4 ++++
|
|
3 files changed, 27 insertions(+)
|
|
|
|
diff --git a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c
|
|
index 37b481c..564e6d3 100644
|
|
--- a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c
|
|
+++ b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c
|
|
@@ -23,6 +23,7 @@
|
|
#include "pqexpbuffer.h"
|
|
#include "access/xlog.h"
|
|
#include "catalog/pg_type.h"
|
|
+#include "fe_utils/connect.h"
|
|
#include "funcapi.h"
|
|
#include "mb/pg_wchar.h"
|
|
#include "miscadmin.h"
|
|
@@ -210,6 +211,22 @@ libpqrcv_connect(const char *conninfo, bool logical, const char *appname,
|
|
return NULL;
|
|
}
|
|
|
|
+ if (logical)
|
|
+ {
|
|
+ PGresult *res;
|
|
+
|
|
+ res = libpqrcv_PQexec(conn->streamConn,
|
|
+ ALWAYS_SECURE_SEARCH_PATH_SQL);
|
|
+ if (PQresultStatus(res) != PGRES_TUPLES_OK)
|
|
+ {
|
|
+ PQclear(res);
|
|
+ ereport(ERROR,
|
|
+ (errmsg("could not clear search path: %s",
|
|
+ pchomp(PQerrorMessage(conn->streamConn)))));
|
|
+ }
|
|
+ PQclear(res);
|
|
+ }
|
|
+
|
|
conn->logical = logical;
|
|
|
|
return conn;
|
|
diff --git a/src/backend/replication/logical/worker.c b/src/backend/replication/logical/worker.c
|
|
index bd60094..07b765a 100644
|
|
--- a/src/backend/replication/logical/worker.c
|
|
+++ b/src/backend/replication/logical/worker.c
|
|
@@ -1548,6 +1548,12 @@ ApplyWorkerMain(Datum main_arg)
|
|
BackgroundWorkerInitializeConnectionByOid(MyLogicalRepWorker->dbid,
|
|
MyLogicalRepWorker->userid);
|
|
|
|
+ /*
|
|
+ * Set always-secure search path, so malicious users can't redirect user
|
|
+ * code (e.g. pg_index.indexprs).
|
|
+ */
|
|
+ SetConfigOption("search_path", "", PGC_SUSET, PGC_S_OVERRIDE);
|
|
+
|
|
/* Load the subscription into persistent memory context. */
|
|
ApplyContext = AllocSetContextCreate(TopMemoryContext,
|
|
"ApplyContext",
|
|
diff --git a/src/test/subscription/t/001_rep_changes.pl b/src/test/subscription/t/001_rep_changes.pl
|
|
index 0136c79..cda275b 100644
|
|
--- a/src/test/subscription/t/001_rep_changes.pl
|
|
+++ b/src/test/subscription/t/001_rep_changes.pl
|
|
@@ -16,6 +16,10 @@ $node_subscriber->init(allows_streaming => 'logical');
|
|
$node_subscriber->start;
|
|
|
|
# Create some preexisting content on publisher
|
|
+$node_publisher->safe_psql(
|
|
+ 'postgres',
|
|
+ "CREATE FUNCTION public.pg_get_replica_identity_index(int)
|
|
+ RETURNS regclass LANGUAGE sql AS 'SELECT 1/0'"); # shall not call
|
|
$node_publisher->safe_psql('postgres',
|
|
"CREATE TABLE tab_notrep AS SELECT generate_series(1,10) AS a");
|
|
$node_publisher->safe_psql('postgres',
|
|
--
|
|
2.23.0
|