Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5518
| From | Roberto C. Sánchez <roberto@debian.org> |
|---|---|
| Newsgroups | linux.debian.security |
| Subject | Re: RFC: proposed fix for CVE-2018-19518 in uw-imap |
| Date | 2018-12-28 15:30 +0100 |
| Message-ID | <xa1jb-5el-3@gated-at.bofh.it> (permalink) |
| References | <x82CJ-7hv-1@gated-at.bofh.it> <x8GgO-61K-7@gated-at.bofh.it> <x9RWx-86a-3@gated-at.bofh.it> <xa1jb-5el-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Hi Tomas, On Fri, Dec 28, 2018 at 12:53:00PM +0000, Tomas Bortoli wrote: > > By shell escaping I meant to escape all the special shell characters > within the input. That'd probably need additional dependencies or a neat > sanitizer function. > > But I was wrong, it's unnecessary as there's no shell interpreter there > but it's just using `execv` to get rsh/ssh running. > > I agree that preventing the injection of spaces will prevent the > injection of additional parameters and therefore the execution of > unexpected commands. > Thanks for the feedback and confirmation. Regards, -Roberto -- Roberto C. Sánchez
Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-23 04:30 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-24 22:50 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-26 09:50 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-25 12:30 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 05:30 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 15:30 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-28 19:30 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Ola Lundqvist <ola@inguza.com> - 2018-12-28 21:50 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-29 16:30 +0100
RE: RFC: proposed fix for CVE-2018-19518 in uw-imap COSTEY Anthony <a.costey@caenlamer.fr> - 2018-12-29 17:10 +0100
Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Salvatore Bonaccorso <carnil@debian.org> - 2018-12-30 09:40 +0100
Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap Magnus Holmgren <holmgren@debian.org> - 2019-02-24 20:40 +0100
csiph-web