[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87bk6he8h4.fsf_-_@melete.silentflame.com>
Date: Wed, 10 Apr 2024 19:57:11 +0800
From: Sean Whitton <spwhitton@...hitton.name>
To: Ihor Radchenko <yantar92@...teo.net>
Cc: emacs@...kages.debian.org, emacs-devel@....org,
oss-security@...ts.openwall.com
Subject: Re: Is CVE-2024-30203 bogus? (Emacs)
Hello,
On Mon 08 Apr 2024 at 06:44pm GMT, Ihor Radchenko wrote:
> Sean Whitton <spwhitton@...hitton.name> writes:
>
>> The description for CVE-2024-30203 is
>>
>> In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
>
> Before Emacs 29.3, there was no concept of trusted or untrusted content
> in Emacs. We introduced it specifically to control whether we allow
> running LaTeX on the contents of a given buffer. (And even in Emacs
> 29.3, the concept of untrusted contents is not yet official) So, at least
> the title is misleading.
Right, it's a purely preliminary change, not fixing any holes in itself.
>> and for CVE-2024-30204 is
>>
>> In Emacs before 29.3, LaTeX preview is enabled by default for e-mail
>> attachments.
>
> This is closer to what was happening.
> Note that LaTeX preview itself was not a problem. The problem was that we
> executed actual latex program without user query with input taken from
> buffer text to generate the previews (using the default settings). LaTeX
> input can be specifically constructed to cause DOS when using LaTeX
> compiler, which is especially dangerous when the input is coming from
> emails.
>
> Also, only GNUS and MUA clients re-using gnus libs (at least, notmuch
> and mu4e) were affected. Not rmail, AFAIK.
>
>> ...
>> I think it's the first one -- can you confirm?
>
> I hope that the above clarified things.
Hmm, thank you, but let me ask a follow-up question: do you agree with
me that there is only one security flaw covered by these two CVEs, and
CVE-2024-30203 is the superfluous one?
--
Sean Whitton
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
