Skip site navigation (1) Skip section navigation (2)

pgsql: Prevent access to external files/URLs via contrib/xml2'sxslt_pr

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Prevent access to external files/URLs via contrib/xml2'sxslt_pr
Date: 2012-08-14 22:33:41
Message-ID: (view raw, whole thread or download thread mbox)
Lists: pgsql-committers
Prevent access to external files/URLs via contrib/xml2's xslt_process().

libxslt offers the ability to read and write both files and URLs through
stylesheet commands, thus allowing unprivileged database users to both read
and write data with the privileges of the database server.  Disable that
through proper use of libxslt's security options.

Also, remove xslt_process()'s ability to fetch documents and stylesheets
from external files/URLs.  While this was a documented "feature", it was
long regarded as a terrible idea.  The fix for CVE-2012-3489 broke that
capability, and rather than expend effort on trying to fix it, we're just
going to summarily remove it.

While the ability to write as well as read makes this security hole
considerably worse than CVE-2012-3489, the problem is mitigated by the fact
that xslt_process() is not available unless contrib/xml2 is installed,
and the longstanding warnings about security risks from that should have
discouraged prudent DBAs from installing it in security-exposed databases.

Reported and fixed by Peter Eisentraut.

Security: CVE-2012-3488



Modified Files
contrib/xml2/expected/xml2.out   |   15 ++++++++
contrib/xml2/expected/xml2_1.out |   15 ++++++++
contrib/xml2/sql/xml2.sql        |   15 ++++++++
contrib/xml2/xslt_proc.c         |   72 ++++++++++++++++++++++++++++----------
doc/src/sgml/xml2.sgml           |    8 ----
5 files changed, 98 insertions(+), 27 deletions(-)

pgsql-committers by date

Next:From: Tom LaneDate: 2012-08-14 22:33:42
Subject: pgsql: Prevent access to external files/URLs via XML entityreferences.
Previous:From: Peter EisentrautDate: 2012-08-14 20:44:21
Subject: pgsql: Translation updates

Privacy Policy | About PostgreSQL
Copyright © 1996-2018 The PostgreSQL Global Development Group