[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <50a7cedc-8a0b-4f59-8861-7fdf0c23ecff@gmail.com>
Date: Fri, 25 Apr 2025 14:58:15 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: vulnerabilities in busybox tar and cpio tools
On 4/24/25 7:57 PM, Solar Designer wrote:
> On Thu, Apr 24, 2025 at 07:09:44PM -0400, Demi Marie Obenour wrote:
>> On 4/24/25 3:09 AM, Albert Veli wrote:
>>> On Wed, Apr 23, 2025 at 10:51 PM Salvatore Bonaccorso <carnil@...ian.org> wrote:
>>>> FTR, this one has assigned CVE-2025-46394
>>>> ...
>>>> FTR, this one has CVE-2024-58251 assigned.
>>>
>>> From what I can tell the latest release is busybox-1.37.0. Are these fixed
>>> in this release? If not, do you have any link to patches I can apply to fix
>>> these issues?
>>>
>>> Regards,
>>> Albert
>>
>> This message was marked as spam by GMail. The ARC-Authentication-Results
>> header indicates that the mailing list is not configured in a DMARC-compatible
>> way. Specifically, the mailing list did not rewrite the From: header but did
>> modify the message body, so the DKIM signature check failed.
>
> This was a special case - DKIM-breaking message body modification
> shouldn't normally happen here.
>
> However, the list is indeed not DMARC-compatible: we insert
> [oss-security] into the Subject when it's not already near the beginning
> of that header (may break DKIM), and we relay messages from the list
> server's IP address (may be against the From header domain's SPF,
> although recipient servers may look at envelope-from instead, which we
> do rewrite, so SPF will match in that respect).
SPF won’t be a problem so long as the message is DKIM-signed.
> For now, this is simply how it is. Most delivery problems occur when
> the sender's domain has strict DMARC policy ("p=reject"), so e.g. when
> someone from google.com posts, the message doesn't get through to
> subscribers on gmail.com. For gmail.com to gmail.com, everything is
> usually "fine" for now.
gmail.com now has p=quarantine, so this is already starting to cause
problems even there. I think it is best to either rewrite the From
header unless there is a DKIM signature and it is kept intact, or
bounce the message instructing the user to add [oss-security] to the
Subject themselves.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
