Request a Demo
Home   >   mailing lists

Path Traversal Vulnerability in pg_dump Directory Format - Mailing list pgsql-hackers

From Dilip Kumar
Subject Path Traversal Vulnerability in pg_dump Directory Format
Date
Msg-id CAFiTN-v8aH1ZMNuN5xQr_TRFM0Dbcg7A6BU2s5Y5=XNPey2BRQ@mail.gmail.com
Whole thread
Responses Re: Path Traversal Vulnerability in pg_dump Directory Format
List pgsql-hackers
Tree view 
I would like to submit a patch to address a path traversal
vulnerability in pg_dump's directory format mode (-F d). Currently,
filenames listed in directory-format TOC files (toc.dat and
blobs_*.toc) are treated as trusted when reading an archive during a
restore. If an archive entry filename is maliciously modified to
contain path traversal elements (such as ..) or directory separators,
pg_restore can be tricked into reading files outside the intended
backup directory.  The attached patch fixes this vulnerability.

-- 
Regards,
Dilip Kumar
Google
Attachment

pgsql-hackers by date:

Previous
From: Alberto Piai
Date:
Subject: Re: Adding a stored generated column without long-lived locks
Next
From: Michael Paquier
Date:
Subject: Re: GIN amcheck leaks memory in gin_check_parent_keys_consistency