Re: Possible to store invalid SCRAM-SHA-256 Passwords - Mailing list pgsql-bugs

From Michael Paquier
Subject Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date
Msg-id 20190423065701.GL2712@paquier.xyz
Whole thread Raw
In response to Re: Possible to store invalid SCRAM-SHA-256 Passwords  (Michael Paquier <michael@paquier.xyz>)
Responses Re: Possible to store invalid SCRAM-SHA-256 Passwords  ("Jonathan S. Katz" <jkatz@postgresql.org>)
List pgsql-bugs
On Tue, Apr 23, 2019 at 11:10:18AM +0900, Michael Paquier wrote:
> That's a hard morning...  Yes you are right and I can see the failure.
> By the way, grouping everything in one patch looks more adapted to me
> as this tightens all the checks for the different verifier types.

The afternoon has been better.  I have double-checked your patch and
committed it down to v10.  Now, there are two things which may need
extra handling:
- Do we add a note in the release notes about that with a SQL query
checking the state of pg_authid?
- In ~9.6 we include in md5.h a macro which does not care about hex
characters in the MD5 hash.  I think that we should fix that as well,
or perhaps that's not worth caring per the lack of complaints?
Attached is what would be needed.
--
Michael

Attachment

pgsql-bugs by date:

Previous
From: PG Bug reporting form
Date:
Subject: BUG #15775: pg_get_indexdef: could not open relation with OID 16385
Next
From: "Jonathan S. Katz"
Date:
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords