diff options
| author | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2017-05-23 05:55:19 -0400 |
|---|---|---|
| committer | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2017-05-23 05:55:19 -0400 |
| commit | 1c9b6e818f047e07f1de62b4d11e0c5db2d55ab7 (patch) | |
| tree | fbfa448ffd17094640689a9280c45af8ee9eda12 /src/backend/utils/adt/misc.c | |
| parent | d951db2eff9e31637669a1452a0260616fdb5f50 (diff) | |
| download | postgresql-1c9b6e818f047e07f1de62b4d11e0c5db2d55ab7.tar.gz postgresql-1c9b6e818f047e07f1de62b4d11e0c5db2d55ab7.zip | |
Verify that the server constructed the SCRAM nonce correctly.
The nonce consists of client and server nonces concatenated together. The
client checks the nonce contained the client nonce, but it would get fooled
if the server sent a truncated or even empty nonce.
Reported by Steven Fackler to security@postgresql.org. Neither me or Steven
are sure what harm a malicious server could do with this, but let's fix it.
Diffstat (limited to 'src/backend/utils/adt/misc.c')
0 files changed, 0 insertions, 0 deletions