On Thu, Apr 24, 2025 at 07:09:44PM -0400, Demi Marie Obenour wrote: On 4/24/25 3:09 AM, Albert Veli wrote: On Wed, Apr 23, 2025 at 10:51 PM Salvatore Bonaccorso <carnil () debian org> wrote: FTR, this one has assigned CVE-2025-46394 ... FTR, this one has CVE-2024-58251 assigned. From what I can tell the latest release is busybox-1.37.0. Are these fixed in this release? If not, do you have any link to patches I can apply to fix these issues?
Regards, Albert This message was marked as spam by GMail. The ARC-Authentication-Results header indicates that the mailing list is not configured in a DMARC-compatible way. Specifically, the mailing list did not rewrite the From: header but did modify the message body, so the DKIM signature check failed. This was a special case - DKIM-breaking message body modification shouldn't normally happen here.
However, the list is indeed not DMARC-compatible: we insert [oss-security] into the Subject when it's not already near the beginning of that header (may break DKIM), and we relay messages from the list server's IP address (may be against the From header domain's SPF, although recipient servers may look at envelope-from instead, which we do rewrite, so SPF will match in that respect).
For now, this is simply how it is. Most delivery problems occur when the sender's domain has strict DMARC policy ("p=reject"), so e.g. when someone from google.com posts, the message doesn't get through to subscribers on gmail.com. For gmail.com to gmail.com, everything is usually "fine" for now.
Yes, we may need to bite the bullet and add From header rewriting.
Alexander
I reported this one in busybox's netstat a year ago:
https://bugs.busybox.net/showbug.cgi?id=15922
The whole code needs a security audit for ANSI escapes like this.
Best,
R
On 4/23/25 4:11 PM, Ian Norton wrote: https://bugs.busybox.net/showbug.cgi?id=16018 (awaiting CVE)
Busybox's cpio and tar tools will print un-escaped filenames when listing and unpacking cpio and tar files. Malicious files containing filenames with terminal escapes can be used to mask or modify earlier or later files in the archive from anyone running busybox tar or cpio from a terminal.
see also https://lists.busybox.net/pipermail/busybox/2024-July/090806.html
https://security-tracker.debian.org/tracker/CVE-2023-39810
A unpacking a cpio archive can escape the working directory. Due to #16018 it is possible to mask these traversals from anyone using cpio to inspect a file before unpacking.
see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html
Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.