Postgres Pro
Downloads
Home   >   mailing lists

re: Direct SSL connection and ALPN loose ends - Mailing list pgsql-hackers

From Ranier Vilela
Subject re: Direct SSL connection and ALPN loose ends
Date
Msg-id CAEudQAr=MYq_xYkRcV+gTFydLrVdiMtBxjJ+Lv8ENUEs1gchdQ@mail.gmail.com
Whole thread Raw
In response to Direct SSL connection and ALPN loose ends  (Heikki Linnakangas <hlinnaka@iki.fi>)
Responses Re: Direct SSL connection and ALPN loose ends
List pgsql-hackers
Tree view
Hi,

With TLS 1.3 and others there is possibly a security flaw using ALPN [1].

It seems to me that the ALPN protocol can be bypassed if the client does not correctly inform the ClientHello header.

So, the suggestion is to check the ClientHello header in the server and
terminate the TLS handshake early.

Patch attached.

best regards,
Ranier Vilela

Attachment

pgsql-hackers by date:

Previous
From: Chris Cleveland
Date:
Subject: Possible to get LIMIT in an index access method?
Next
From: Mark Hill
Date:
Subject: CVE's addressed in next update