[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <203c89e3-9edf-40f8-98f0-755c7e107f88@gmail.com>
Date: Thu, 22 Jan 2026 18:25:36 -0500
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com, Simon Josefsson <simon@...efsson.org>
Subject: Re: GNU InetUtils Security Advisory: remote
authentication by-pass in telnetd
On 1/20/26 09:00, Simon Josefsson wrote:
> We chose to sanitize all variables for expansion. The following two
> patches are what we suggest:
>
> https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b
> https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc
If a variable expands to an empty value, will the subsequent code
remove the command-line argument entirely, rather than passing an
empty string? Or should an empty string be treated as an error?
Also, would an allowlist be better than a denylist?
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
