2026-05-05 16:03:54 <el[m]1> https://cybersecuritynews.com/apache-http-server-rce/ there's a new remote code execution bug for apache web server, in case this didn't reach alpine packaging yet
2026-05-05 16:08:07 <dne> it has been patched on all branches except 3.20-stable
2026-05-05 16:08:11 <ikke> yeah
2026-05-06 11:30:07 <ikke> https://eissing.org/icing/posts/responsible-disclosure/
2026-05-06 11:35:17 <jvoisin> > One developed an RCE which required an unguarded lib
2026-05-06 11:35:21 <jvoisin> what is an "unguarded libc"?
2026-05-07 06:26:51 <sam_> lol
2026-05-07 06:26:55 <sam_> i'd missed that
2026-05-07 06:27:12 <sam_> (much of the rest of it wasn't something I agreed with so.>)
2026-05-07 06:27:13 <sam_> *..
2026-05-07 06:51:46 <ikke> sam_: you mean the premise that responsible disclosure is no longer feasible?
2026-05-07 06:51:55 <newhere> hm
2026-05-07 06:57:56 <sam_> ikke: yes, and that somehow just releasing it whenever and relying on distros to notice is useful, and more scalable than making a release or informing distros together
2026-05-07 06:58:11 <sam_> ikke: you don't even *have* to make a release if you don't want to, but put out some advisory
2026-05-07 10:16:36 <omni> I think I've always leaned towards full disclosure being the responsible one
2026-05-07 10:23:59 <jvoisin> (the right way to spell "responsible disclosure" is "coordinated disclosure". Iirc it was Microsoft who branded it responsible)
2026-05-07 10:25:46 <ikke> right
2026-05-07 10:31:39 <sam_> regardless of opinions on it being embargoed or not, it should be clearly communicated in a timely manner with some decent advisory and information
2026-05-07 10:31:47 <sam_> not LLM generated garbage or with references strippe dout
2026-05-07 10:32:11 <jvoisin> ^
2026-05-07 10:33:07 <omni> what about obfuscated proof of concept code?
2026-05-07 10:33:23 <ikke> security through obscurity?
2026-05-07 10:34:03 <omni> it's a joke about the copy.fail PoC being obfuscated
2026-05-07 10:34:08 <jvoisin> was it?
2026-05-07 10:34:14 <jvoisin> it was a tad minified for fun
2026-05-07 10:34:17 <sam_> i think more golfed is a better way of putting it
2026-05-07 10:34:20 <jvoisin> I wouldn't call that obfuscation
2026-05-07 10:34:22 <omni> sure
2026-05-07 10:34:30 <sam_> (I still found it funny :))
2026-05-07 10:37:12 <omni> in some sense, yes, but not for people in a stressful situation who would've liked something more easy to digest
2026-05-07 10:40:14 <sam_> i meant what you said, not what they did
2026-05-07 10:40:31 <sam_> i found their disclosure shitty in a few ways (ignoring ethics and timing and blah blah
2026-05-07 10:40:32 <sam_> )
2026-05-07 10:40:36 <sam_> the focus on byte code, python, and also suid
2026-05-07 10:40:41 <sam_> *byte count
2026-05-07 10:40:51 <sam_> it meant a lot of confused people
2026-05-07 10:48:33 <omni> a case of irresponsible disclosure, perhaps
2026-05-07 10:48:48 <ikke> uncoordinated disclosure* :P
2026-05-07 10:54:33 <jvoisin> CARROT DISCLOSURE!
2026-05-07 10:54:37 <jvoisin> (ok, never again, ok)
2026-05-07 10:55:04 <sam_> i resisted even referencing it out of concern for your mental health
2026-05-07 10:55:47 <jvoisin> 24h without having received hate mail, it's ok, we can now all laugh about it :D
2026-05-07 15:41:21 <invoked> https://forum.torproject.org/t/security-release-0-4-8-24-and-0-4-9-7/21551
2026-05-07 19:07:28 <ikke> Another linux LPE? https://www.openwall.com/lists/oss-security/2026/05/07/8 (Dirty Frag)
2026-05-07 19:08:22 <achill> lol what
2026-05-07 19:10:00 <ikke> No patches or anything
2026-05-07 19:11:16 <ikke> https://github.com/V4bel/dirtyfrag
2026-05-07 19:11:24 <achill> yeah looking at it right now
2026-05-07 19:11:26 <achill> interesting
2026-05-07 19:15:29 <ikke> Mitigation is disabling a couple of modules
2026-05-07 19:16:27 <achill> hm are you able to reproduce it?
2026-05-07 19:16:41 <ikke> I haven't tried yet
2026-05-07 19:17:38 <achill> doesnt work for me, might need some further adjustments to alpine
2026-05-07 19:20:02 <achill> but the embargo being "broken" so that there is no patch is surely intersting
2026-05-07 19:23:16 <achill> not sure if there is something we as a distro should do, disabling the module in the kernels? idk
2026-05-07 19:25:07 <ikke> Funny, if I search for esp6, most pages are about exploits
2026-05-07 19:26:25 <ikke> I don't think we should start disabling modules. 
2026-05-07 19:26:30 <achill> yeah
2026-05-07 19:26:57 <achill> INET_ESP is again some ipsec thingy lol
2026-05-07 19:27:06 <ikke> We use esp4
2026-05-07 19:27:10 <ikke> but apparently not esp6
2026-05-07 19:27:13 <ikke> (our dmvpn uses it)
2026-05-07 19:27:19 <achill> ah i see
2026-05-07 19:27:31 <ikke> It's used by strongswan
2026-05-07 19:27:42 <ikke> https://docs.strongswan.org/docs/latest/install/kernelModules.html
2026-05-07 19:28:28 <achill> yeah then sounds like a more broader used module
2026-05-07 19:56:05 <jvoisin> maybe it's time to do a pass on Alpine's modules
2026-05-07 20:08:21 <ptrc> https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4
2026-05-07 20:08:56 <ptrc> at least there's a patch, but still
2026-05-07 20:09:03 <ptrc> what a shitshow
2026-05-07 20:10:11 <ikke> I suppose we should get used to it
2026-05-08 01:03:48 <jahway603> Can I please have both !102078 and its backport !102079 merged? This version was released today and includes 2 new security fixes with CVE pending.
2026-05-08 08:48:13 <dne> dirtyfrag assigned CVE-2026-43284: https://www.cve.org/CVERecord?id=CVE-2026-43284
2026-05-08 08:48:47 <dne> fixed in kernels 6.18.28, 6.12.87, 6.6.138
2026-05-08 08:52:26 <ikke> dne: thanks!
2026-05-08 08:53:08 <dne> and unaffected before 6.5…
2026-05-08 08:53:25 <ikke> Ok, also good to know
2026-05-08 08:53:44 <ikke> So >=6.6.0?
2026-05-08 08:54:09 <dne> seems so
2026-05-08 08:54:17 <ikke> Sorry, >=6.5.0
2026-05-08 08:56:06 <dne> hm right, must be
2026-05-08 08:57:11 <Foxboron> fwiw, the recent stable releases does not have all the fixes. They are working on the last patch
2026-05-08 09:29:12 <omni> https://afflicted.sh/blog/posts/copy-fail-2.html
2026-05-08 10:24:55 <ncopa> https://www.openwall.com/lists/oss-security/2026/05/08/8
2026-05-08 10:25:38 <ikke> ugh
2026-05-08 10:48:37 <dne> ugh indeed