On Fri, Mar 13, 2026 at 01:19:49PM +0000, Stuart Henderson wrote: On 2026/03/13 06:37, Justin Swartz wrote: OpenBSD 7.8 [PARTIAL LEAKAGE] The client blocks most variables which have not been explicitly exported, but potentially sensitive variables such as DISPLAY, XAUTHORITY and PRINTER are leaked without prior export. ha, we've had that for a long time.

--------------------- Date: 2005/02/27 15:46:42 Author: otto Branch: HEAD Tag: OPENBSD37BASE Log: - only send exported vars (based on a diff from Solar Designer) - fix some buffer overflows (also some Solar Designer input)

ok deraadt@ cloder@

Members: authenc.c:1.6->1.7 commands.c:1.47->1.48 externs.h:1.13->1.14 telnet.c:1.18->1.19 --------------------- Oh, I didn't recall.

Looking at this now:

https://cvsweb.openbsd.org/src/usr.bin/telnet

I see that these exports are explicit in commands.c:

envexport("DISPLAY"); envexport("PRINTER"); envexport("XAUTHORITY");

Also, there's support for the TERMINAL-TYPE (RFC 1091) and X-DISPLAY-LOCATION (RFC 1096) telnet protocol options in telnet.c, which would send TERM and DISPLAY even if these are not exported.

Looking at RHEL 9 telnet-0.17-85.el9's telnet-0.17-env.patch against Linux NetKit, I see it also deliberately allows TERM and DISPLAY to be sent via these protocol options even if not exported.

Perhaps these default exports once made sense, but not anymore... except maybe for TERM, which still needs to work out of the box?

I also found there's OpenBSD-derived telnet-bsd package in Gentoo (client and server) and OpenWrt (client only), originally ported by Thorsten Kukuk of SUSE. I didn't check when it was forked, nor whether it already contains the 2005 fixes mentioned above or equivalent. Someone (perhaps involved with those distros) could want to check.

Alexander