2026-05-05 16:03:54 <el[m]1> https://cybersecuritynews.com/apache-http-server-rce/ there's a new remote code execution bug for apache web server, in case this didn't reach alpine packaging yet
2026-05-05 16:08:07 <dne> it has been patched on all branches except 3.20-stable
2026-05-05 16:08:11 <ikke> yeah
2026-05-06 11:30:07 <ikke> https://eissing.org/icing/posts/responsible-disclosure/
2026-05-06 11:35:17 <jvoisin> > One developed an RCE which required an unguarded lib
2026-05-06 11:35:21 <jvoisin> what is an "unguarded libc"?
2026-05-07 06:26:51 <sam_> lol
2026-05-07 06:26:55 <sam_> i'd missed that
2026-05-07 06:27:12 <sam_> (much of the rest of it wasn't something I agreed with so.>)
2026-05-07 06:27:13 <sam_> *..
2026-05-07 06:51:46 <ikke> sam_: you mean the premise that responsible disclosure is no longer feasible?
2026-05-07 06:51:55 <newhere> hm
2026-05-07 06:57:56 <sam_> ikke: yes, and that somehow just releasing it whenever and relying on distros to notice is useful, and more scalable than making a release or informing distros together
2026-05-07 06:58:11 <sam_> ikke: you don't even *have* to make a release if you don't want to, but put out some advisory
2026-05-07 10:16:36 <omni> I think I've always leaned towards full disclosure being the responsible one
2026-05-07 10:23:59 <jvoisin> (the right way to spell "responsible disclosure" is "coordinated disclosure". Iirc it was Microsoft who branded it responsible)
2026-05-07 10:25:46 <ikke> right
2026-05-07 10:31:39 <sam_> regardless of opinions on it being embargoed or not, it should be clearly communicated in a timely manner with some decent advisory and information
2026-05-07 10:31:47 <sam_> not LLM generated garbage or with references strippe dout
2026-05-07 10:32:11 <jvoisin> ^
2026-05-07 10:33:07 <omni> what about obfuscated proof of concept code?
2026-05-07 10:33:23 <ikke> security through obscurity?
2026-05-07 10:34:03 <omni> it's a joke about the copy.fail PoC being obfuscated
2026-05-07 10:34:08 <jvoisin> was it?
2026-05-07 10:34:14 <jvoisin> it was a tad minified for fun
2026-05-07 10:34:17 <sam_> i think more golfed is a better way of putting it
2026-05-07 10:34:20 <jvoisin> I wouldn't call that obfuscation
2026-05-07 10:34:22 <omni> sure
2026-05-07 10:34:30 <sam_> (I still found it funny :))
2026-05-07 10:37:12 <omni> in some sense, yes, but not for people in a stressful situation who would've liked something more easy to digest
2026-05-07 10:40:14 <sam_> i meant what you said, not what they did
2026-05-07 10:40:31 <sam_> i found their disclosure shitty in a few ways (ignoring ethics and timing and blah blah
2026-05-07 10:40:32 <sam_> )
2026-05-07 10:40:36 <sam_> the focus on byte code, python, and also suid
2026-05-07 10:40:41 <sam_> *byte count
2026-05-07 10:40:51 <sam_> it meant a lot of confused people
2026-05-07 10:48:33 <omni> a case of irresponsible disclosure, perhaps
2026-05-07 10:48:48 <ikke> uncoordinated disclosure* :P
2026-05-07 10:54:33 <jvoisin> CARROT DISCLOSURE!
2026-05-07 10:54:37 <jvoisin> (ok, never again, ok)
2026-05-07 10:55:04 <sam_> i resisted even referencing it out of concern for your mental health
2026-05-07 10:55:47 <jvoisin> 24h without having received hate mail, it's ok, we can now all laugh about it :D
2026-05-07 15:41:21 <invoked> https://forum.torproject.org/t/security-release-0-4-8-24-and-0-4-9-7/21551
2026-05-07 19:07:28 <ikke> Another linux LPE? https://www.openwall.com/lists/oss-security/2026/05/07/8 (Dirty Frag)
2026-05-07 19:08:22 <achill> lol what
2026-05-07 19:10:00 <ikke> No patches or anything
2026-05-07 19:11:16 <ikke> https://github.com/V4bel/dirtyfrag
2026-05-07 19:11:24 <achill> yeah looking at it right now
2026-05-07 19:11:26 <achill> interesting
2026-05-07 19:15:29 <ikke> Mitigation is disabling a couple of modules
2026-05-07 19:16:27 <achill> hm are you able to reproduce it?
2026-05-07 19:16:41 <ikke> I haven't tried yet
2026-05-07 19:17:38 <achill> doesnt work for me, might need some further adjustments to alpine
2026-05-07 19:20:02 <achill> but the embargo being "broken" so that there is no patch is surely intersting
2026-05-07 19:23:16 <achill> not sure if there is something we as a distro should do, disabling the module in the kernels? idk
2026-05-07 19:25:07 <ikke> Funny, if I search for esp6, most pages are about exploits
2026-05-07 19:26:25 <ikke> I don't think we should start disabling modules. 
2026-05-07 19:26:30 <achill> yeah
2026-05-07 19:26:57 <achill> INET_ESP is again some ipsec thingy lol
2026-05-07 19:27:06 <ikke> We use esp4
2026-05-07 19:27:10 <ikke> but apparently not esp6
2026-05-07 19:27:13 <ikke> (our dmvpn uses it)
2026-05-07 19:27:19 <achill> ah i see
2026-05-07 19:27:31 <ikke> It's used by strongswan
2026-05-07 19:27:42 <ikke> https://docs.strongswan.org/docs/latest/install/kernelModules.html
2026-05-07 19:28:28 <achill> yeah then sounds like a more broader used module
2026-05-07 19:56:05 <jvoisin> maybe it's time to do a pass on Alpine's modules
2026-05-07 20:08:21 <ptrc> https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4
2026-05-07 20:08:56 <ptrc> at least there's a patch, but still
2026-05-07 20:09:03 <ptrc> what a shitshow
2026-05-07 20:10:11 <ikke> I suppose we should get used to it
2026-05-08 01:03:48 <jahway603> Can I please have both !102078 and its backport !102079 merged? This version was released today and includes 2 new security fixes with CVE pending.
2026-05-08 08:48:13 <dne> dirtyfrag assigned CVE-2026-43284: https://www.cve.org/CVERecord?id=CVE-2026-43284
2026-05-08 08:48:47 <dne> fixed in kernels 6.18.28, 6.12.87, 6.6.138
2026-05-08 08:52:26 <ikke> dne: thanks!
2026-05-08 08:53:08 <dne> and unaffected before 6.5…
2026-05-08 08:53:25 <ikke> Ok, also good to know
2026-05-08 08:53:44 <ikke> So >=6.6.0?
2026-05-08 08:54:09 <dne> seems so
2026-05-08 08:54:17 <ikke> Sorry, >=6.5.0
2026-05-08 08:56:06 <dne> hm right, must be
2026-05-08 08:57:11 <Foxboron> fwiw, the recent stable releases does not have all the fixes. They are working on the last patch
2026-05-08 09:29:12 <omni> https://afflicted.sh/blog/posts/copy-fail-2.html
2026-05-08 10:24:55 <ncopa> https://www.openwall.com/lists/oss-security/2026/05/08/8
2026-05-08 10:25:38 <ikke> ugh
2026-05-08 10:48:37 <dne> ugh indeed
2026-05-08 16:42:17 <j-lane> just checked the logs dirty frag is patched in latest but not copy-fail-2 right?
2026-05-08 19:01:47 <ncopa> yeah. but I think you can blacklist the rxrpc module
2026-05-08 19:02:55 <ikke> ftr, they're gone already
2026-05-11 06:53:42 <dne> kernel 6.18.29 released: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.29
2026-05-11 06:57:58 <dne> i.e. the fix for CVE-2026-43500
2026-05-11 07:13:51 <ikke> dne: great! Are there releases for other LTS branches as well?
2026-05-11 07:17:55 <dne> not yet, it seems (only for 7.0 so far)
2026-05-11 07:19:44 <ikke> Is that 7.0.6?
2026-05-11 07:20:24 <dne> yeah
2026-05-13 07:17:42 <dne> 2 recent CVEs in expat: !101468 !101469 !101470 !101471 have been ready for a while
2026-05-13 07:19:39 <dne> one of them related to https://github.com/python/cpython/issues/149018
2026-05-13 11:49:41 <sam_> another: https://github.com/v12-security/pocs/tree/main/fragnesia
2026-05-13 11:50:33 <ikke> The gift that keeps on giving
2026-05-13 16:20:49 <dne> "fragnesia" has been assigned CVE-2026-46300
2026-05-13 16:26:16 <ikke> dne: thanks
2026-05-13 19:15:35 <ikke> "In other words, the effective vulnerability window is from f4c50a4034e6 (2026-05-05) to upstream -- approximately 9 days."
2026-05-14 11:57:46 <el[m]1> https://github.com/DepthFirstDisclosures/Nginx-Rift there seems to be a pretty intense nginx vulnerability here. at least in terms of version number, alpine stable seems to be shipping the affected version
2026-05-14 13:06:18 <ikke> el[m]1: hmm, thanks for sharing
2026-05-14 13:37:32 <sam_> it's a bot overhyped as-is
2026-05-14 13:37:34 <sam_> *bit
2026-05-14 13:37:40 <sam_> still matters but needs aslr bypass which they dont have
2026-05-14 13:44:08 <el[m]1> sam_: without the bypass it would still be a DoS problem i'm guessing? bypass is just for the remote execution part, isnt it?
2026-05-14 13:45:39 <el[m]1> (not that i care either way. i just drop the vulns here for visibility. i don't really care about the speed a patch arrives, i simply wanna help it not getting missed entirely)
2026-05-14 13:54:18 <sam_> yes
2026-05-14 13:54:28 <sam_> and yeah, totally fair, I just wanted to mention it because I've seen some people panic 
2026-05-14 15:07:50 <ikke> Latest stable kernels do not include the fragnesia patches yet
2026-05-14 16:22:02 <ikke> sam_: seems like the existing patches are not sufficient for fragnesia
2026-05-14 16:22:13 <ikke> or rather, the initial patches
2026-05-14 16:22:20 <sam_> yeah, trying v3 now
2026-05-14 22:33:10 <fluix> re: nginx & aslr needing to be off, the technical writeup mentions an approach towards bypassing ASLR
2026-05-14 22:33:26 <fluix> not POC code, but I would assume quick patches are still a good idea
2026-05-15 06:54:15 <ikke> https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
2026-05-15 13:49:28 <ikke> ncopa: new stable kernels dropped
2026-05-15 15:07:10 <ikke> !102460
2026-05-15 15:29:55 <ikke> oops/ s/6.8/6.18/
2026-05-15 19:06:55 <ikke> ssh-keysign-pwn: CVE-2026-46333
2026-05-15 21:36:32 <ncopa> building kernels for stable branches now. will push tomorrow morning
2026-05-16 17:04:54 <ikke> v5 patch for Fragnesia: https://lore.kernel.org/netdev/ageeJfJHwgzmKXbh@v4bel/#r
2026-05-17 16:00:42 <ikke> New kernels, still no patch for Fragnesia
2026-05-19 12:10:11 <jahway603> Can I please have !102643 security backport merged?
2026-05-20 07:23:14 <ikke> https://github.com/RsyncProject/rsync/blob/master/NEWS.md 6 rsync CVES
2026-05-20 07:31:32 <ncopa> workign on it
2026-05-20 09:31:46 <dne> 11 new CVEs in unbound, including one RCE: !102691
2026-05-20 09:36:11 <ikke> Ouc
2026-05-20 09:36:15 <ikke> h
2026-05-20 12:55:21 <ikke> Woop, yet another one: https://github.com/Delphos-Labs/disclosures/tree/main/DirtyCBC
2026-05-20 12:56:30 <ikke> Allegedly, CVE-2026-31635
2026-05-20 15:03:39 <invoked> six bind vulns, all rce
2026-05-20 15:04:29 <invoked> i suppose this is just a coincidence. ;)
2026-05-20 15:06:12 <ikke> I suppose they're a bit in a bind
2026-05-20 15:06:45 <invoked> i overstated that, i'm not sure they're all rce, but they are all remotely exploitable
2026-05-21 08:15:52 <ikke> For the record, DirtCBC/DirtyDecrypt had already been patched and only affected versions between 6.16 and 6.18. That repo published a PoC exploit for it, though
2026-05-21 15:59:40 <invoked> all the dns vulns happening at the same time wasn't a coincidence, after all: https://indico.dns-oarc.net/event/56/contributions/1233/attachments/1180/2539/presentation.pdf
2026-05-21 17:45:38 <ikke> PinTheft, yet another kernel LPE (https://www.openwall.com/lists/oss-security/2026/05/19/6)
2026-05-21 18:04:32 <ikke> Requires the rds kernel module, which we have enabled. CVE-2026-43494
2026-05-21 18:09:58 <ikke> https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=e174929793195e0cd6a4adb0cad731b39f9019b4
2026-05-23 13:43:43 <jahway603[m]> Question re: 3.23 community/i2pd aport: it was updated in edge as !97355 b/c it "has critical security vulnerability fixes", but never backported to 3.23. I backported the latest release as !102706 - my question being is this considered a security backport then for 3.23?
2026-05-23 13:54:09 <omni> it said nowhere in !97355 that is "has critical security vulnerability fixes", so that was not the reason
2026-05-23 13:54:24 <omni> the ChangeLog isn't clear on that either https://github.com/PurpleI2P/i2pd/blob/2.60.0/ChangeLog
2026-05-23 20:53:31 <omni> sorry about that, a commenter did say that in the MR
2026-05-23 23:38:22 <omni> I think gnupg 2.4.x is EoL, https://www.gnupg.org/