pgcrypto: Add option to revert to prior decryption behavior
The previous commit raises an ERROR during PGP operations if OpenSSL
does not support the cipher in use. However, any existing messages
created with faulty encryption will no longer be accessible via
pgp_[sym|pub]_decrypt().
To help users out of this situation, add a new ignore-cipher-failure
option which reverts to the broken behavior during decryption only. A
faulty encryption wrapper, created by an OpenSSL configuration that does
not support the cipher, can then be stripped back off by that same
OpenSSL in order to safely reencrypt it. (Note that when OpenSSL does
support the cipher, corrupted messages will not be decrypted regardless
of the ignore-cipher-failure setting; this is unchanged.)
The new tests add a corrupted Blowfish message for both public- and
symmetric-key decryption, resulting in the following test matrix:
- Blowfish supported, default behavior: fails to decrypt
- Blowfish supported, ignore-cipher-failure: fails to decrypt
- Blowfish unsupported, default behavior: fails to load cipher
- Blowfish unsupported, ignore-cipher-failure: strips faulty encryption
The previous commit's change to the pubkey tests is expanded similarly:
correctly encrypted messages cannot be decrypted by an OpenSSL that does
not support the cipher, regardless of the option's setting, though the
failure mode will change.
Suggested-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Noah Misch <noah@leadboat.com>
Security: CVE-2026-14663
Backpatch-through: 14
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/49e795414848bbd1f5122f64c0645827d8d90313
Author: Jacob Champion <jchampion@postgresql.org>
Modified Files
--------------
contrib/pgcrypto/expected/pgp-decrypt.out | 26 ++++++++++++++++++
contrib/pgcrypto/expected/pgp-decrypt_1.out | 30 ++++++++++++++++++++
contrib/pgcrypto/expected/pgp-info.out | 3 +-
contrib/pgcrypto/expected/pgp-pubkey-decrypt.out | 30 ++++++++++++++++++++
contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out | 30 ++++++++++++++++++++
contrib/pgcrypto/pgp-cfb.c | 21 ++++++++++----
contrib/pgcrypto/pgp-decrypt.c | 9 ++++--
contrib/pgcrypto/pgp-encrypt.c | 6 ++--
contrib/pgcrypto/pgp-pgsql.c | 2 ++
contrib/pgcrypto/pgp-pubkey.c | 9 +++++-
contrib/pgcrypto/pgp.c | 9 ++++++
contrib/pgcrypto/pgp.h | 7 ++++-
contrib/pgcrypto/sql/pgp-decrypt.sql | 26 ++++++++++++++++++
contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql | 27 ++++++++++++++++++
doc/src/sgml/pgcrypto.sgml | 32 ++++++++++++++++++++++
15 files changed, 254 insertions(+), 13 deletions(-)
